Server-Side Request Forgery (SSRF) in Shopware Flow Builder

CVE-2024-22408

What is CVE-2024-22408?

The Flow Builder functionality in Shopware's open headless commerce platform contains a vulnerability that inadequately validates the URLs used in the 'call webhook' action. This lack of proper validation allows attackers to send web requests to internal hosts, potentially compromising the security of the affected systems. To mitigate this vulnerability, users are advised to update to the latest Commercial Plugin release, version 6.5.7.4, or install the Security Plugin for existing installations of Shopware 6.4 and earlier versions. Regular updates and adherence to security recommendations are essential for ensuring the integrity of Shopware applications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References