CVE-2024-31447 Shopware has Improper Session Handling in store-api
Attackers can maintain active sessions after logout via store-api, bypassing authentication controls in Shopware 6.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-31447?
CVE-2024-31447 is a medium-severity authentication bypass vulnerability in Shopware Shopware, published on 8 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.
Weakness: CWE-613
Which versions are affected by CVE-2024-31447?
8 open source packages ship an affected version, including shopware/core and shopware/platform. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
shopware/core Packagist | From 6.3.5.0 | 6.5.8.8 |
shopware/core Packagist | From 6.3.5.0 | 6.5.8.8 |
shopware/core Packagist | From 6.6.0.0-rc1 | 6.6.1.0 |
shopware/core Packagist | From 6.6.0.0-rc1 | 6.6.1.0 |
shopware/platform Packagist | From 6.3.5.0 | 6.5.8.8 |
shopware/platform Packagist | From 6.3.5.0 | 6.5.8.8 |
2 more packages
shopware/platform Packagist | From 6.6.0.0-rc1 | 6.6.1.0 |
shopware/platform Packagist | From 6.6.0.0-rc1 | 6.6.1.0 |
Products include Shopware Shopware.
How do I fix CVE-2024-31447?
Upgrade shopware/core to a fixed version for your release line: 6.5.8.8 or 6.6.1.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-31447 being exploited?
There is no known exploitation of CVE-2024-31447 in the wild and no public exploit code.
Other vulnerabilities in Shopware Shopware
- CVE-2023-22731 Improper Control of Generation of Code in Twig rendered views in shopware
- CVE-2016-3109 Shopware RCE Vulnerability
- CVE-2024-22406 Blind SQL-injection in DAL aggregations in Shopware
- CVE-2021-32711 Leak of information via Store-API
- CVE-2026-31887 Shopware unauthenticated data extraction possible through store-api.order endpoint
Sources
Also known as GHSA-5297-wrrp-rcj7.