CVE-2023-34099 (published 2023-06-27T17:15Z)

Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-754
cwe_name: Improper Check for Unusual or Exceptional Conditions
description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
extended_description: 
            The programmer may assume that certain events or conditions will never occur or do not need to be worried about, such as low memory conditions, lack of access to resources due to restrictive permissions, or misbehaving clients or components. However, attackers may intentionally trigger these unusual conditions, thus violating the programmer's assumptions, possibly introducing instability, incorrect behavior, or a vulnerability.
            Note that this entry is not exclusively about the use of exceptions and exception handling, which are mechanisms for both checking and handling unusual or unexpected conditions.
         
         

Fix information:
repo_url: https://github.com/shopware5/shopware
commit_details: repo_url: https://github.com/shopware5/shopware
author: Susanne Hartung
author_date: 2023-05-09 09:42:26+02:00
msg: SW-27102 - changing custom email validation to PHPs FILTER_VALIDATE_EMAIL
repository: repo_url: https://github.com/shopware5/shopware
repo_name: shopware5/shopware
description: Shopware 5 core
repo_language: PHP
owner: shopware5
file_changes: filename: .phpstan-baseline.neon
change_type: ModificationType.MODIFY
diff: @@ -42925,26 +42925,6 @@ parameters:
 			count: 1
 			path: tests/Unit/Components/DispatchFormatHelperTest.php
 
-		-
-			message: "#^Method Shopware\\\\Tests\\\\Unit\\\\Components\\\\EmailValidatorTest\\:\\:getValidEmails\\(\\) has no return type specified\\.$#"
-			count: 1
-			path: tests/Unit/Components/EmailValidatorTest.php
-
-		-
-			message: "#^Method Shopware\\\\Tests\\\\Unit\\\\Components\\\\EmailValidatorTest\\:\\:getinvalidEmails\\(\\) has no return type specified\\.$#"
-			count: 1
-			path: tests/Unit/Components/EmailValidatorTest.php
-
-		-
-			message: "#^Method Shopware\\\\Tests\\\\Unit\\\\Components\\\\EmailValidatorTest\\:\\:testInvalidEmails\\(\\) has no return type specified\\.$#"
-			count: 1
-			path: tests/Unit/Components/EmailValidatorTest.php
-
-		-
-			message: "#^Method Shopware\\\\Tests\\\\Unit\\\\Components\\\\EmailValidatorTest\\:\\:testValidEmails\\(\\) has no return type specified\\.$#"
-			count: 1
-			path: tests/Unit/Components/EmailValidatorTest.php
-
 		-
 			message: "#^Method Shopware\\\\Tests\\\\Unit\\\\Components\\\\Escaper\\\\EscaperTest\\:\\:testItCastsNullToEmptyStrings\\(\\) has no return type specified\\.$#"
 			count: 1

programming_language: Go
filename: EmailValidator.php
change_type: ModificationType.MODIFY
diff: @@ -34,8 +34,6 @@ class EmailValidator implements EmailValidatorInterface
      */
     public function isValid($emailAddress)
     {
-        // Inspired by the regex used in symfony/validator
-        // See: https://github.com/symfony/validator/blob/dae70b74fe173461395cfd61a5c5245e05e511f5/Constraints/EmailValidator.php#L72
-        return (bool) preg_match('/^\S+\@\S+\.\S+$/', $emailAddress);
+        return (bool) filter_var($emailAddress, FILTER_VALIDATE_EMAIL);
     }
 }

programming_language: PHP
filename: EmailValidatorTest.php
change_type: ModificationType.MODIFY
diff: @@ -29,76 +29,80 @@ use Shopware\Components\Validator\EmailValidator;
 
 class EmailValidatorTest extends TestCase
 {
-    /**
-     * @var EmailValidator
-     */
-    private $SUT;
+    private EmailValidator $SUT;
 
     protected function setUp(): void
     {
         $this->SUT = new EmailValidator();
     }
 
-    public function getValidEmails()
+    /**
+     * @return array<string, array<int, string>>
+     */
+    public function getValidEmails(): array
     {
         return [
             // old domains
-            ['test@example.de'],
-            ['test@example.com'],
-            ['test@example.org'],
+            'test@example.de' => ['test@example.de'],
+            'test@example.com' => ['test@example.com'],
+            'test@example.org' => ['test@example.org'],
 
             // new released domains
-            ['test@example.berlin'],
-            ['test@example.email'],
-            ['test@example.systems'],
+            'test@example.berlin' => ['test@example.berlin'],
+            'test@example.email' => ['test@example.email'],
+            'test@example.systems' => ['test@example.systems'],
 
             // new non released domains
-            ['test@example.active'],
-            ['test@example.love'],
-            ['test@example.video'],
-            ['test@example.app'],
-            ['test@example.shop'],
+            'test@example.active' => ['test@example.active'],
+            'test@example.love' => ['test@example.love'],
+            'test@example.video' => ['test@example.video'],
+            'test@example.app' => ['test@example.app'],
+            'test@example.shop' => ['test@example.shop'],
 
-            ['disposable.style.email.with+symbol@example.com'],
-            ['other.email-with-dash@example.com'],
-
-            // We will ignore quoted string local parts
-            // this would blow up the simple regex method
-            // array('"much.more unusual"@example.com'),
+            'disposable.style.email.with+symbol@example.com' => ['disposable.style.email.with+symbol@example.com'],
+            'other.email-with-dash@example.com' => ['other.email-with-dash@example.com'],
+            '"much.more.unusual"@example.com' => ['"much.more.unusual"@example.com'],
+            '!#$%&*+-/=?^_`.{|}~@example.com' => ['!#$%&*+-/=?^_`.{|}~@example.com'],
         ];
     }
 
     /**
      * @dataProvider getValidEmails
-     *
-     * @param string $email
      */
-    public function testValidEmails($email)
+    public function testValidEmails(string $email): void
     {
         static::assertTrue($this->SUT->isValid($email));
     }
 
-    public function getinvalidEmails()
+    /**
+     * @return array<string, array<int, string>>
+     */
+    public function getInvalidEmails(): array
     {
         return [
-            ['test'],
-            ['test@.de'],
-            ['@example'],
-            ['@example.de'],
-            ['@.'],
-            [' @foo.de'],
-            ['@foo.'],
-            ['foo@ .de'],
-            ['foo@bar. '],
+            'test' => ['test'],
+            'test@.de' => ['test@.de'],
+            '@example' => ['@example'],
+            '@example.de' => ['@example.de'],
+            '@.' => ['@.'],
+            ' @foo.de' => [' @foo.de'],
+            '@foo.' => ['@foo.'],
+            'foo@ .de' => ['foo@ .de'],
+            'foo@bar. ' => ['foo@bar. '],
+            "testing@example.com'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(" => ["testing@example.com'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR("],
+            "testing@example.com'||''||'" => ["testing@example.com'||''||'"],
+            "testing@example.com'|||'" => ["testing@example.com'|||'"],
+            "testing@example.com'||'" => ["testing@example.com'||'"],
+            'test@example.com|' => ['test@example.com|'],
+            'test@example.com(' => ['test@example.com('],
+            'test@example.com"' => ['test@example.com"'],
         ];
     }
 
     /**
      * @dataProvider getInvalidEmails
-     *
-     * @param string $email
      */
-    public function testInvalidEmails($email)
+    public function testInvalidEmails(string $email): void
     {
         static::assertFalse($this->SUT->isValid($email));
     }

programming_language: PHP