CVE-2019-12935

Vulnerability

Description Shopware versions prior to 5.5.8 contain a reflected cross-site scripting (XSS) vulnerability in the backend login functionality. The issue occurs because user-supplied input in the query string is not properly sanitized before being reflected in the response on the /backend/Login and /backend/Login/load/ URIs. This allows an attacker to inject arbitrary HTML and JavaScript code. [1][2]

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing a query string with XSS payloads, such as ?"-->. The victim must be tricked into clicking the crafted link; no authentication is required to access the login page. The attack is non-persistent (reflected) and requires user interaction. [3][4]

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser if the victim is authenticated to the Shopware backend. This can lead to session hijacking, credential theft, or other actions performed on behalf of the victim. The CVSS score is 6.1 (medium), with a network attack vector and low complexity. [2]

Mitigation

The vulnerability is fixed in Shopware version 5.5.8, which was released on April 8, 2019. Users are advised to upgrade to this or a later version. The vendor acknowledged the issue and released a fix promptly after disclosure. [1][4]