Listen to this Post
This vulnerability exists in the Storefront login page (/account/login). The Twig template responsible for rendering the login error page directly outputs user-controlled URL parameters `waitTime` and `errorSnippet` without proper sanitization or escaping. An attacker crafts a malicious URL containing JavaScript payloads within these parameters. When an administrator or user is tricked into clicking the link, the server reflects the unprocessed payload directly into the HTML response. The victim’s browser then executes the injected script in the context of the vulnerable domain. Because sensitive session cookies lack the `HttpOnly` flag and admin JWTs are stored in sessionStorage, the script can steal these tokens, leading to full session compromise and unauthorized administrative access.
Platform: Shopware
Version: < 6.4.8.0
Vulnerability: Reflected XSS
Severity: Critical
Date: 2022-03-29
Prediction: 2022-04-12
What Undercode Say:
curl -s "https://target.com/account/login?loginError=1&errorSnippet=<script>alert(document.domain)</script>" | grep -o '<script>' cat /path/to/template/login.html.twig | grep 'errorSnippet|waitTime'
How Exploit:
- Attacker crafts phishing link with malicious `errorSnippet` parameter.
2. Victim (admin) clicks link while authenticated.
3. Injected script executes, exfiltrating `sessionStorage` JWT.
4. Attacker hijacks admin session.
Protection from this CVE
1. Update to Shopware >= 6.4.8.0.
2. Implement strict output encoding.
3. Apply proper input validation.
4. Set `HttpOnly` on cookies.
Impact:
Session Hijacking
Admin Privilege Escalation
Account Takeover
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
