CVE-2021-37707: Insufficient Information (NVD-CWE-noinfo)
value: Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2021-08-16T19:15Z
Repository: https://github.com/shopware/platform
Language: PHP
Files changed: src/Core/Content/Product/SalesChannel/Review/ProductReviewSaveRoute.php, src/Core/Content/Test/Product/SalesChannel/Review/ProductReviewSaveRouteTest.php
Commit date: 2021-08-02 16:28:57 +0200
Commit message: NEXT-15681 - Improve product review validation

Diff: diff --git a/src/Core/Content/Product/SalesChannel/Review/ProductReviewSaveRoute.php b/src/Core/Content/Product/SalesChannel/Review/ProductReviewSaveRoute.php
index f0791f66603..8c7236d603b 100644
--- a/src/Core/Content/Product/SalesChannel/Review/ProductReviewSaveRoute.php
+++ b/src/Core/Content/Product/SalesChannel/Review/ProductReviewSaveRoute.php
@@ -183,10 +183,11 @@ class ProductReviewSaveRoute extends AbstractProductReviewSaveRoute
             $criteria->addFilter(new EqualsFilter('id', $data->get('id')));
 
             $definition->add('id', new EntityExists([
                 'entity' => 'product_review',
                 'context' => $context,
+                'criteria' => $criteria,
             ]));
         } else {
             $criteria = new Criteria();
             $criteria->addFilter(new EqualsFilter('customerId', $data->get('customerId')));
             $criteria->addFilter(new EqualsFilter('productId', $data->get('productId')));
diff --git a/src/Core/Content/Test/Product/SalesChannel/Review/ProductReviewSaveRouteTest.php b/src/Core/Content/Test/Product/SalesChannel/Review/ProductReviewSaveRouteTest.php
index bb565951a8c..f1e33a734fc 100644
--- a/src/Core/Content/Test/Product/SalesChannel/Review/ProductReviewSaveRouteTest.php
+++ b/src/Core/Content/Test/Product/SalesChannel/Review/ProductReviewSaveRouteTest.php
@@ -10,10 +10,11 @@ use Shopware\Core\Defaults;
 use Shopware\Core\Framework\Context;
 use Shopware\Core\Framework\Test\TestCaseBase\IntegrationTestBehaviour;
 use Shopware\Core\Framework\Test\TestCaseBase\SalesChannelApiTestBehaviour;
 use Shopware\Core\Framework\Test\TestDataCollection;
 use Shopware\Core\Framework\Uuid\Uuid;
+use Symfony\Component\HttpFoundation\Response;
 
 /**
  * @group store-api
  */
 class ProductReviewSaveRouteTest extends TestCase
@@ -118,10 +119,43 @@ class ProductReviewSaveRouteTest extends TestCase
 
         static::assertEquals($response['errors'][0]['source']['pointer'], '/title');
         static::assertEquals($response['errors'][1]['source']['pointer'], '/content');
     }
 
+    public function testCustomerValidation(): void
+    {
+        $this->login();
+
+        $this->assertReviewCount(0);
+
+        $id = Uuid::randomHex();
+
+        // Create review
+        $this->browser->request('POST', $this->getUrl(), [
+            'id' => $id,
+            'title' => 'Lorem ipsum dolor sit amet',
+            'content' => 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna',
+        ]);
+
+        // Re-login as another user
+        $this->login();
+
+        // Try to use the id from previous review which is not attached to this customer
+        $this->browser->request('POST', $this->getUrl(), [
+            'id' => $id,
+            'title' => 'Lorem ipsum dolor sit amet',
+            'content' => 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna',
+        ]);
+
+        $response = $this->browser->getResponse();
+
+        static::assertSame(Response::HTTP_BAD_REQUEST, $response->getStatusCode());
+        $content = json_decode($response->getContent(), true);
+
+        static::assertSame('VIOLATION::ENTITY_DOES_NOT_EXISTS', $content['errors'][0]['code']);
+    }
+
     private function assertReviewCount(int $expected): void
     {
         $count = $this->getContainer()
             ->get(Connection::class)
             ->fetchColumn('SELECT COUNT(*) FROM product_review WHERE product_id = :id', ['id' => Uuid::fromHexToBytes($this->ids->get('product'))]);

Fixed code:                 'criteria' => $criteria,
use Symfony\Component\HttpFoundation\Response;
    public function testCustomerValidation(): void
    {
        $this->login();

        $this->assertReviewCount(0);

        $id = Uuid::randomHex();

        // Create review
        $this->browser->request('POST', $this->getUrl(), [
            'id' => $id,
            'title' => 'Lorem ipsum dolor sit amet',
            'content' => 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna',
        ]);

        // Re-login as another user
        $this->login();

        // Try to use the id from previous review which is not attached to this customer
        $this->browser->request('POST', $this->getUrl(), [
            'id' => $id,
            'title' => 'Lorem ipsum dolor sit amet',
            'content' => 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna',
        ]);

        $response = $this->browser->getResponse();

        static::assertSame(Response::HTTP_BAD_REQUEST, $response->getStatusCode());
        $content = json_decode($response->getContent(), true);

        static::assertSame('VIOLATION::ENTITY_DOES_NOT_EXISTS', $content['errors'][0]['code']);
    }