-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a reflected Cross-Site Scripting (XSS) issue on the Shopware Storefront login page. The analysis of the provided patch c9242c02c84595d9fa3e2adf6a264bc90a657b58 reveals that the loginPage function within the AuthController.php file was the source of the vulnerability. The function was taking the waitTime and errorSnippet parameters directly from the HTTP request's query string using $request->get(). These parameters were then passed to the Twig template (login.html.twig) without sufficient sanitization, where they were rendered. This allowed an attacker to craft a malicious URL containing JavaScript in these parameters, which would be executed in the context of the victim's browser when they visited the link. The patch addresses this by changing the code to use $request->attributes->get() instead. This ensures that the values are retrieved from the request's attributes, which are controlled by the application's routing and internal logic, rather than directly from user-controllable query parameters. Additionally, the Twig template was updated to apply stricter sanitization rules, such as using number_format for the waitTime parameter, as a defense-in-depth measure.
Shopware\Storefront\Controller\AuthController::loginPagesrc/Storefront/Controller/AuthController.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/shopware | composer | >= 6.4.6.0, < 6.6.10.10 | 6.6.10.10 |
| shopware/storefront | composer | >= 6.4.6.0, < 6.6.10.10 | 6.6.10.10 |
| shopware/shopware | composer | >= 6.7.0.0, < 6.7.5.1 | 6.7.5.1 |
| shopware/storefront | composer | >= 6.7.0.0, < 6.7.5.1 | 6.7.5.1 |
A Semantic Attack on Google Gemini - Read the Latest Research