-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/shopware | composer | >= 6.4.6.0, < 6.6.10.10 | 6.6.10.10 |
| shopware/storefront | composer | >= 6.4.6.0, < 6.6.10.10 | 6.6.10.10 |
| shopware/shopware | composer | >= 6.7.0.0, < 6.7.5.1 | 6.7.5.1 |
| shopware/storefront | composer | >= 6.7.0.0, < 6.7.5.1 | 6.7.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is a reflected Cross-Site Scripting (XSS) issue on the Storefront login page. The analysis of the provided patch c9242c02c84595d9fa3e2adf6a264bc90a657b58 reveals the root cause. The loginPage method within the Shopware\Storefront\Controller\AuthController class was identified as the vulnerable function. Previously, this function directly retrieved the waitTime and errorSnippet parameters from the request's query string using $request->get(). These parameters were then passed to the login.html.twig template. The template rendered these values without sufficient escaping or sanitization, as evidenced by the changes in the patch that add stricter sanitization rules (sw_sanitize({}, true) and number_format). The vulnerability was fixed by changing the controller to read these values from the request's attributes, which are presumably sanitized earlier in the request lifecycle, and by applying stricter sanitization in the template. Therefore, any runtime profile during exploitation would show the Shopware\Storefront\Controller\AuthController::loginPage function as the entry point for processing the malicious request and rendering the vulnerable page.
Shopware\Storefront\Controller\AuthController::loginPagesrc/Storefront/Controller/AuthController.php