GHSA-3pcr-4982-548m Exposure of .env if project root is configured as web root in shopware/production
Attackers can read sensitive .env files if the web root is misconfigured to the project root instead of the public directory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3pcr-4982-548m?
GHSA-3pcr-4982-548m is a vulnerability in shopware/production, published on 13 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
The .env and other sensitive files can be leaked if the project root and not /public is configured as the web root.
Patches
We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
Workarounds
You should always use /public as the web root.
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021
Which versions are affected by GHSA-3pcr-4982-548m?
4 open source packages ship an affected version, including shopware/production and shopware/shopware.
| Package | Affected | Fixed in |
|---|---|---|
shopware/production Packagist | All versions | 6.3.5.3 |
shopware/production Packagist | All versions | 6.3.5.3 |
shopware/shopware Packagist | All versions | 6.3.5.3 |
shopware/shopware Packagist | All versions | 6.3.5.3 |
How do I fix GHSA-3pcr-4982-548m?
Upgrade shopware/production to 6.3.5.3 or later.
Is GHSA-3pcr-4982-548m being exploited?
There is no known exploitation of GHSA-3pcr-4982-548m in the wild and no public exploit code.