GHSA-r64m-qchj-hrjp Webcache Poisoning in shopware/platform and shopware/core
Attackers can poison web caches via X-Forwarded-Prefix headers, potentially serving malicious content to other users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-r64m-qchj-hrjp?
GHSA-r64m-qchj-hrjp is a vulnerability in shopware/core, published on 24 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Webcache Poisoning via X-Forwarded-Prefix and sub-request
Patches
We recommend updating to the current version 6.4.6.1. You can get the update to 6.4.6.1 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/download/#shopware-6
Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Which versions are affected by GHSA-r64m-qchj-hrjp?
4 open source packages ship an affected version, including shopware/core and shopware/platform.
| Package | Affected | Fixed in |
|---|---|---|
shopware/core Packagist | All versions | 6.4.6.1 |
shopware/core Packagist | All versions | 6.4.6.1 |
shopware/platform Packagist | All versions | 6.4.6.1 |
shopware/platform Packagist | All versions | 6.4.6.1 |
How do I fix GHSA-r64m-qchj-hrjp?
Upgrade shopware/core to 6.4.6.1 or later.
Is GHSA-r64m-qchj-hrjp being exploited?
There is no known exploitation of GHSA-r64m-qchj-hrjp in the wild and no public exploit code.