GHSA-m895-2hj3-8cg9: Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

The vulnerability, identified as GHSA-m895-2hj3-8cg9, allows a low-privileged backend user to bypass media visibility restrictions and access private files. This is possible because the authorization checks implemented in MediaVisibilityRestrictionSubscriber were not being applied to aggregation API requests.

The root cause of the vulnerability lies in two main places:

1. Shopware\Core\Framework\DataAbstractionLayer\EntityRepository::aggregate: This function, which is responsible for handling aggregation queries, did not have a mechanism to allow other parts of the application to inspect or modify the aggregation criteria before execution. This meant that no security restrictions could be applied.

2. Shopware\Core\Content\Media\Subscriber\MediaVisibilityRestrictionSubscriber: This subscriber was designed to protect private media, but it only listened for the EntitySearchedEvent, which is related to search queries. It did not have any logic to handle aggregation queries.

An attacker could exploit this by making a crafted aggregation request on media entities. Since the MediaVisibilityRestrictionSubscriber was not triggered, the query would be executed without any security checks, allowing the attacker to enumerate and potentially access sensitive information from private media files.

The patch addresses this by introducing a new event, BeforeEntityAggregationEvent, which is dispatched from the EntityRepository::aggregate method. The MediaVisibilityRestrictionSubscriber is updated to subscribe to this new event and apply the necessary security filters to the aggregation criteria, thus closing the security hole. Any engineer with this CVE in their environment should be aware that any aggregation queries on media entities could be a potential vector for this attack if the system is not patched.