CVE-2021-37707 (published 2021-08-16T19:15Z)

Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability that allows manipulation of product reviews via API. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/shopware/platform
commit_details: repo_url: https://github.com/shopware/platform
author: Soner Sayakci
author_date: 2021-07-27 16:41:56+02:00
msg: NEXT-15681 - Improve product review validation
repository: repo_url: https://github.com/shopware/platform
repo_name: shopware/shopware
description: Shopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 1.500 community extensions
repo_language: PHP
owner: shopware
file_changes: filename: ProductReviewSaveRoute.php
change_type: ModificationType.MODIFY
diff: @@ -185,6 +185,7 @@ class ProductReviewSaveRoute extends AbstractProductReviewSaveRoute
             $definition->add('id', new EntityExists([
                 'entity' => 'product_review',
                 'context' => $context,
+                'criteria' => $criteria,
             ]));
         } else {
             $criteria = new Criteria();

programming_language: PHP
filename: ProductReviewSaveRouteTest.php
change_type: ModificationType.MODIFY
diff: @@ -12,6 +12,7 @@ use Shopware\Core\Framework\Test\TestCaseBase\IntegrationTestBehaviour;
 use Shopware\Core\Framework\Test\TestCaseBase\SalesChannelApiTestBehaviour;
 use Shopware\Core\Framework\Test\TestDataCollection;
 use Shopware\Core\Framework\Uuid\Uuid;
+use Symfony\Component\HttpFoundation\Response;
 
 /**
  * @group store-api
@@ -120,6 +121,39 @@ class ProductReviewSaveRouteTest extends TestCase
         static::assertEquals($response['errors'][1]['source']['pointer'], '/content');
     }
 
+    public function testCustomerValidation(): void
+    {
+        $this->login();
+
+        $this->assertReviewCount(0);
+
+        $id = Uuid::randomHex();
+
+        // Create review
+        $this->browser->request('POST', $this->getUrl(), [
+            'id' => $id,
+            'title' => 'Lorem ipsum dolor sit amet',
+            'content' => 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna',
+        ]);
+
+        // Re-login as another user
+        $this->login();
+
+        // Try to use the id from previous review which is not attached to this customer
+        $this->browser->request('POST', $this->getUrl(), [
+            'id' => $id,
+            'title' => 'Lorem ipsum dolor sit amet',
+            'content' => 'Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna',
+        ]);
+
+        $response = $this->browser->getResponse();
+
+        static::assertSame(Response::HTTP_BAD_REQUEST, $response->getStatusCode());
+        $content = json_decode($response->getContent(), true);
+
+        static::assertSame('VIOLATION::ENTITY_DOES_NOT_EXISTS', $content['errors'][0]['code']);
+    }
+
     private function assertReviewCount(int $expected): void
     {
         $count = $this->getContainer()

programming_language: PHP