CVE-2024-22408 Server-Side Request Forgery (SSRF) in Shopware Flow Builder

High 7.6 Published 16 Jan 2024 Updated 17 Jun 2025

Attackers can exploit inadequate URL validation in Shopware Flow Builder to perform server-side requests to internal hosts.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-22408?

CVE-2024-22408 is a high-severity server-side request forgery vulnerability in Shopware Shopware, published on 16 Jan 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fixed in the Commercial Plugin release 6.5.7.4 or with the Security Plugin. For installations with Shopware 6.4 the Security plugin is recommended to be installed and up to date. For older versions of 6.4 and 6.5 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Weakness: CWE-918

Which versions are affected by CVE-2024-22408?

It affects 1 product.

Products include Shopware Shopware.

How do I fix CVE-2024-22408?

No fix has been published for CVE-2024-22408 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-22408 being exploited?

There is no known exploitation of CVE-2024-22408 in the wild and no public exploit code.

All Shopware Shopware vulnerabilities

Sources

Also known as GHSA-3535-m8vh-vrmw.