CVE-2017-18357 : Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort paramete

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.

Published 2019-01-15 16:29:00

Updated 2019-05-22 03:29:01

Source MITRE

View at NVD, CVE.org

Vulnerability category: XML external entity (XXE) injection

Products affected by CVE-2017-18357

Shopware » Shopware
Versions before (<) 5.3.4
cpe:2.3:a:shopware:shopware:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-18357

EPSS FAQ

33.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 97 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2017-18357

Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE

Disclosure Date: 2019-05-09

First seen: 2020-04-26

exploit/multi/http/shopware_createinstancefromnamedarguments_rce

This module exploits a php object instantiation vulnerability that can lead to RCE in Shopware. An authenticated backend user could exploit the vulnerability. The vulnerability exists in the createInstanceFromNamedArguments function, where the code insufficiently pe

More information

CVSS scores for CVE-2017-18357

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2017-18357

CWE-610 Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-18357

https://demo.ripstech.com/projects/shopware_5.3.3

100% RIPS
Third Party Advisory
https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe/

Shopware 5.3.3: PHP Object Instantiation to Blind XXE
Exploit;Third Party Advisory
http://packetstormsecurity.com/files/152995/Shopware-createInstanceFromNamedArguments-PHP-Object-Instantiation.html

Shopware createInstanceFromNamedArguments PHP Object Instantiation ≈ Packet Storm

Jump to