Description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
shopware shopware
< 6.6.10.18affected>= 6.7.0.0, < 6.7.10.1affected
shopware platform
< 6.6.10.18affected>= 6.7.0.0, < 6.7.10.1affected
References
- https://github.com/shopware/shopware/security/advisories/GHSA-gv8p-48fr-4fxg ↗
- https://github.com/shopware/shopware/commit/1e047f6d7fd9129271e28c1c9f1c272983c6f48f ↗
- https://github.com/shopware/shopware/commit/db5adff33ec30b648979cd1938c87f164f7b3073 ↗
- https://github.com/shopware/shopware/releases/tag/v6.6.10.18 ↗
- https://github.com/shopware/shopware/releases/tag/v6.7.10.1 ↗