GHSA-7vvp-j573-5584
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
Quick fix
GHSA-7vvp-j573-5584 — shopware/core: upgrade to the fixed version with the command below.
composer require shopware/core:^6.7.8.1Details
### Summary
An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the `deepLinkCode` support on the `store-api.order` endpoint.
### Details
#### Data Exposure
Depending on the order payload configuration, attackers may retrieve: - Customer names - Billing address - Shipping address - Email addresses - Ordered products - Order values - Order numbers - Order dates - Payment method information - Shipping method information - More customs, depending on the given associations in the request
#### Security Impact
This vulnerability allows: - Unauthorized access to foreign customer order data - Mass enumeration of recent orders - Potential scraping of customer personal information
#### Limitation
No limitation, but only orders from the past 30 days are checked for changeable means of payment (unrelated).
### Impact
The code is present since ~2021. Likely every version since then is impacted for every store.
Are you affected?
Enter the version of the package you're using.
Affected packages
6.7.0.0Fixed in: 6.7.8.1composer require shopware/core:^6.7.8.10Fixed in: 6.6.10.15composer require shopware/core:^6.6.10.156.7.0.0Fixed in: 6.7.8.1composer require shopware/platform:^6.7.8.10Fixed in: 6.6.10.15composer require shopware/platform:^6.6.10.15