Shopware unauthenticated data extraction possible through store-api.order endpoint

Summary

An insufficient check on the filter types for unauthenticated customers in Shopware 6 allows access to orders of other customers. This vulnerability resides in the deepLinkCode support on the store-api.order endpoint.

Root

Cause

The code does not properly restrict filter types when an unauthenticated request is made via the deepLinkCode mechanism on the order endpoint [1]. As a result, an attacker can query order data for any customer without authentication.

Exploitation

An unauthenticated attacker can send crafted requests to the store-api.order endpoint that bypass the intended access controls. No special privileges or prior knowledge beyond the endpoint URL is required. The deepLinkCode functionality is meant to allow limited order lookups, but the insufficient filter check enables broader data retrieval.

Impact

A successful exploit can expose a wide range of sensitive customer data, including names, billing and shipping addresses, email addresses, ordered products, order values, order numbers, order dates, payment method details, and shipping method information [3]. This could lead to privacy breaches, identity theft, or targeted phishing attacks. The vulnerability affects versions prior to 6.7.8.1 and 6.6.10.15, and the code has been present since roughly 2021 [3].

Mitigation

Shopware has addressed the issue in versions 6.7.8.1 and 6.6.10.15 [1]. Users are strongly advised to update to these or later versions. No workarounds have been publicly released.