^{CVE-2023-34098:}Incorrect .htaccess configuration in Shopware allows exposure of package-lock.json file, enabling version fingerprinting.

Overview

This vulnerability affects Shopware e-commerce software versions prior to 5.7.18. The core issue is an improperly configured .htaccess file that does not block access to the themes/package-lock.json file. This file contains detailed version information about the Shopware installation and its dependencies. By accessing this file, attackers can precisely identify which version of Shopware is running on a target system, enabling them to research and exploit known vulnerabilities specific to that version. This type of information disclosure is particularly dangerous as it eliminates the need for attackers to use trial-and-error methods to determine which exploits might be effective against a target system.

Remediation

Users of Shopware should update to version 5.7.18 or later, which contains a fix for this vulnerability. The update properly configures the .htaccess file to prevent access to the package-lock.json file, thus preventing version fingerprinting by potential attackers.

There are no known workarounds for this vulnerability other than updating to the patched version. If immediate updating is not possible, administrators should consider implementing additional security measures such as:

• Using a web application firewall (WAF) to block access to the themes/package-lock.json file
• Implementing IP-based access restrictions to sensitive files
• Regularly monitoring access logs for attempts to access the vulnerable file

References

1. Shopware Security Update Advisory: https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
2. GitHub Security Advisory: https://github.com/shopware/shopware/security/advisories/GHSA-q97c-2mh3-pgw9
3. Patch Commit: https://github.com/shopware5/shopware/commit/b3518c8d9562a38615d638f31f79829f6e2f4b6a
4. Release Notes for Version 5.7.18: https://www.shopware.com/en/changelog-sw5/#5-7-18