CVE-2023-2017 is a high-severity vulnerability affecting Shopware 6, an e-commerce platform. This Server-side Template Injection (SSTI) vulnerability impacts both shopware/core and shopware/platform GitHub repositories, allowing remote attackers to bypass validation checks and execute arbitrary code or commands. Systems running Shopware versions 6.1.0 up to 6.4.20.0, and versions 6.5.0.0-rc1 to 6.5.0.0-rc3 are at risk.

How do I know if I'm affected?

If you're using Shopware 6, an e-commerce platform, you might be affected by the CVE-2023-2017 vulnerability. This issue is a high-severity Server-side Template Injection (SSTI) that allows remote attackers to execute arbitrary code or commands. You're at risk if your system runs Shopware versions 6.1.0 up to 6.4.20.0, or versions 6.5.0.0-rc1 to 6.5.0.0-rc3. To check your Shopware version, log in to your Shopware administration panel and navigate to the settings menu. If you find your version falls within the affected range, it's crucial to update your software to the latest version.

What should I do if I'm affected?

If you're affected by the CVE-2023-2017 vulnerability, it's important to act quickly. First, update your Shopware to version 6.4.20.1 using the auto-updater or manually via the download package. If you're using an older version, install the central security plugin for Shopware 6. Always keep your software up-to-date to prevent future vulnerabilities.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-2017 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity Server-side Template Injection (SSTI) in Shopware 6 allows remote attackers to bypass security checks and execute arbitrary code or commands. To resolve this issue, users should update their Shopware software to version 6.4.20.1.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-94, CWE-184, CWE-1336 involves improper code generation and control in Shopware 6's Twig rendered views, leading to potential arbitrary code execution.

For more details

CVE-2023-2017 is a high-severity vulnerability in Shopware 6, allowing remote attackers to execute arbitrary code via Server-side Template Injection (SSTI). To learn more about this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the links below.

• Shopware Security Update 04/2023

• GitHub Advisory for Shopware

• STAR Labs Advisory on CVE-2023-2017