[FD] [RT-SA-2017-012] Shopware Cart Accessible by Third-Party Websites

Advisory: Shopware Cart Accessible by Third-Party Websites RedTeam Pentesting discovered that the shopping cart implemented by Shopware offers an insecure API. Malicious, third-party websites may abuse this API to list, add or remove products from a user's cart. Details ======= Product: Shopware Affected Versions: 4.0.1 - 5.3.7 Fixed Versions: > 5.4.0 Vulnerability Type: Cross-Site Request Forgery Security Risk: low Vendor URL: https://shopware.com Vendor Status: fixed version released Advisory URL: http://ift.tt/2IpWZog Advisory Status: published CVE: GENERIC-MAP-NOMATCH CVE URL: http://ift.tt/1jQGmEN Introduction ============ "Shopware 5 is the next generation of open source e-commerce software made in Germany. Based on bleeding edge technologies like Symfony 2, Doctrine 2 & Zend Framework Shopware comes as the perfect platform for your next e-commerce project. Furthermore Shopware 5 provides an event-driven plugin system and an advanced hook system, giving you the ability to customize every part of the platform." (from the Shopware GitHub repository [1]) More Details ============ The Shopware web application provides users with a virtual shopping cart to collect products prior to checkout. This cart is displayed to the user as a modal sidebar appearing at the right edge of the browser window. Consequently, Shopware implements several API endpoints to allow JavaScript code to perform shopping cart operations. These endpoints are implemented in the "Shopware_Controllers_Frontend_Checkout" class and can be reached through the following paths: * /checkout/ajaxCart * /checkout/ajaxAddArticleCart * /checkout/ajaxDeleteArticleCart RedTeam Pentesting discovered that API endpoints support JSONP by specifying a URL parameter named callback. The origin of calls to the cart API is not validated. Therefore, any third-party website may make use of this API. If a customer of a Shopware shop visits a malicious, attacker-controlled website, JavaScript code on this site may access the user's shopping cart. Proof of Concept ================ The following JavaScript snippets demonstrate how to access the cart of a Shopware shop at "https://example.net" from a third-party website. The "getJSON" function of jQuery 3 is used to interface with the JSONP API. By running the following code, the contents of a cart may be retrieved. The result of the API call is displayed on the browser's developer console.

Source: Gmail -> IFTTT-> Blogger