Improper Control of Generation of Code in Twig Rendered Views in Shopware

Also known as GHSA-7v2v-9rm4-7m8f

Published 3 y ago 2023-04-17 · modified 14 d ago 2026-10-24 · JSON

CVSS

8.8

v3.1 · CNA

CISA KEV

not known exploited

EPSS

2.1%

percentile 81%

Public exploits

none known

Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\Core\Framework\Adapter\Twig\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: no
Technical impact: total
Assessed: 21 mo ago 2025-02-05

Exploit prediction (EPSS)

2.07% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CNA	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
GitHub	3.1	8.8	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
packagist	`shopware/platform`	<6.4.20.1	6.4.20.1
packagist	`shopware/core`	<6.4.20.1	6.4.20.1

Affected products

Shopware AG Shopware 6

Classification

Weakness

CWE-184 Incomplete List of Disallowed Inputs
CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
CWE-94 Improper Control of Generation of Code

References

docs.shopware.com /en/shopware-6-en/security-updates/security-update-04-2023 · vendor-advisory, x_transferred
github.com /shopware/platform/security/advisories/GHSA-7v2v-9rm4-7m8f · vendor-advisory, x_transferred
starlabs.sg /advisories/23/23-2017/ · third-party-advisory, x_transferred
github.com /shopware/shopware/security/advisories/GHSA-7v2v-9rm4-7m8f · web
nvd.nist.gov /vuln/detail/CVE-2023-2017 · advisory
github.com /shopware/platform · package
github.com /shopware/platform/releases/tag/v6.4.20.1 · web
starlabs.sg /advisories/23/23-2017 · web

Sources

CVE List: CVE-2023-2017
GitHub Advisory: GHSA-7v2v-9rm4-7m8f
NVD: CVE-2023-2017

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary