{"id":"CVE-2023-2017","published":"2023-04-17T10:18:27Z","modified":"2025-02-05T20:46:43Z","title":"Improper Control of Generation of Code in Twig Rendered Views in Shopware","vendor":"Shopware AG","product":"Shopware 6","tier":"tail","description":{"text":"Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension to bypass the validation checks in `Shopware\\Core\\Framework\\Adapter\\Twig\\SecurityExtension` and call any arbitrary PHP function and thus execute arbitrary code/commands via usage of fully-qualified names, supplied as array of strings, when referencing callables. Users are advised to upgrade to v6.4.20.1 to resolve this issue. This is a bypass of CVE-2023-22731.\n","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02066,"percentile":0.81361,"provenance":"source"},"cwes":[{"id":"CWE-184","name":"Incomplete List of Disallowed Inputs"},{"id":"CWE-1336","name":"Improper Neutralization of Special Elements Used in a Template Engine"}],"references":[{"url":"https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2023","tags":["vendor-advisory"]},{"url":"https://github.com/shopware/platform/security/advisories/GHSA-7v2v-9rm4-7m8f","tags":["vendor-advisory"]},{"url":"https://starlabs.sg/advisories/23/23-2017/","tags":["third-party-advisory"]}],"priority":{"score":22.4,"factors":[{"name":"EPSS percentile","points":16.27},{"name":"CVSS severity","points":6.16}]},"vendorSlug":"shopware","affectedVersions":[{"vendor":"Shopware AG","product":"Shopware 6","versions":["<= 6.4.20.0",">= 6.5.0.0-rc1, <= 6.5.0.0-rc4"]}],"affected":[{"ecosystem":"Packagist","package":"shopware/platform","vulnerableRanges":["<6.4.20.1"],"patched":["6.4.20.1"],"from":["GHSA-7v2v-9rm4-7m8f"],"provenance":"source"},{"ecosystem":"Packagist","package":"shopware/core","vulnerableRanges":["<6.4.20.1"],"patched":["6.4.20.1"],"from":["GHSA-7v2v-9rm4-7m8f"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1231","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-shopware-platform-cve-2021-32717","parents":[{"from":"CVE-2023-22731","to":"CVE-2023-2017","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This is a bypass of CVE-2023-22731.","from":"CVE.org","in":"CVE-2023-2017"}]}],"children":[{"from":"CVE-2023-2017","to":"CVE-2026-23498","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array and array crafted PHP Closure not checked being against allow list for the map(...) override.","from":"CVE.org","in":"CVE-2026-23498"},{"kind":"osv-related","provenance":"source","id":"GHSA-7cw6-7h3h-v8pf","via":"reference","url":"https://github.com/advisories/GHSA-7v2v-9rm4-7m8f"}]}],"packageHistory":[{"cve":"CVE-2023-22732","published":"2023-01-17","fixed":"6.4.18.1","kev":false},{"cve":"CVE-2023-22733","published":"2023-01-17","fixed":"6.4.18.1","kev":false},{"cve":"CVE-2023-22734","published":"2023-01-17","fixed":"6.4.18.1","kev":false},{"cve":"CVE-2023-2017","published":"2023-04-17","fixed":"6.4.20.1","kev":false},{"cve":"CVE-2024-22406","published":"2024-01-16","fixed":"6.5.7.4","kev":false,"link":{"from":"CVE-2023-2017","to":"CVE-2024-22406","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:shopware/platform","fromFixed":"6.4.20.1","toFixed":"6.5.7.4","daysApart":274},{"kind":"version-step","provenance":"source","package":"Packagist:shopware/core","fromFixed":"6.4.20.1","toFixed":"6.5.7.4","daysApart":274}]}},{"cve":"CVE-2024-22407","published":"2024-01-16","fixed":"6.5.7.4","kev":false,"link":{"from":"CVE-2023-2017","to":"CVE-2024-22407","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:shopware/platform","fromFixed":"6.4.20.1","toFixed":"6.5.7.4","daysApart":274},{"kind":"version-step","provenance":"source","package":"Packagist:shopware/core","fromFixed":"6.4.20.1","toFixed":"6.5.7.4","daysApart":274}]}},{"cve":"CVE-2024-27917","published":"2024-03-06","fixed":"6.5.8.7","kev":false}],"package":"Packagist:shopware/platform"}}