CVE-2024-31447 in Shopware Security Plugin
Summary
by MITRE • 04/08/2024
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Starting in version 6.3.5.0 and prior to versions 6.6.1.0 and 6.5.8.8, when a authenticated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. The problem has been fixed in Shopware 6.6.1.0 and 6.5.8.8. Those who are unable to update can install the latest version of the Shopware Security Plugin as a workaround.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2025
The vulnerability identified as CVE-2024-31447 affects Shopware 6 commerce platform versions between 6.3.5.0 and prior to 6.6.1.0 and 6.5.8.8, representing a session management flaw that creates a persistent security risk for authenticated users. This issue specifically manifests when users make authenticated requests to the store-api endpoint POST /store-api/account/logout, where the system correctly clears the shopping cart but fails to properly terminate the user session. The vulnerability stems from an inconsistent implementation of logout functionality between the Store API and the PHP Storefront components, creating a scenario where users appear logged out of their cart but remain authenticated in the system. This discrepancy represents a classic session management weakness that violates fundamental security principles of proper authentication state handling and could enable unauthorized access to user data and actions.
The technical flaw in CVE-2024-31447 constitutes a session fixation and authentication bypass vulnerability classified under CWE-613, as it creates a scenario where session tokens remain valid even after users attempt to log out. The root cause lies in the asynchronous handling of logout events between different components of the Shopware architecture, where the Store API component processes cart clearance without properly invalidating session tokens, while the PHP Storefront component correctly handles session invalidation through CustomerLogoutEvent listeners. This architectural inconsistency creates a window of opportunity for attackers to exploit the session state, particularly when users navigate between different parts of the application or when session tokens are reused across components. The vulnerability is further exacerbated by the fact that it affects only direct store-api usage, suggesting that the PHP Storefront layer provides additional protection that the API layer lacks.
The operational impact of this vulnerability extends beyond simple session management issues, as it creates potential for data exposure, unauthorized transactions, and privilege escalation within the Shopware environment. Attackers who gain access to a user's session token could continue performing actions with elevated privileges even after the user believes they have logged out, potentially accessing sensitive customer information, modifying orders, or conducting fraudulent transactions. This vulnerability particularly affects e-commerce environments where user sessions are critical for maintaining data integrity and preventing unauthorized access to customer accounts. The persistence of session state after logout operations could enable attackers to maintain access to user accounts during active browsing sessions, creating a significant risk for both customer data protection and business integrity. The vulnerability also impacts the overall security posture of organizations using Shopware 6, as it demonstrates a lack of proper session lifecycle management across different application components.
Mitigation strategies for CVE-2024-31447 require immediate implementation of the vendor-provided patches in Shopware 6.6.1.0 and 6.5.8.8, which resolve the inconsistent logout behavior by ensuring that session tokens are properly invalidated across all application components. Organizations unable to immediately upgrade should implement the Shopware Security Plugin as a temporary workaround, which provides additional session management controls to address the vulnerability. The fix addresses the underlying issue by synchronizing session invalidation across both the Store API and PHP Storefront components, ensuring that logout operations properly terminate user sessions in all contexts. Security teams should also implement monitoring for unauthorized logout operations and session persistence patterns to detect potential exploitation attempts. The vulnerability highlights the importance of maintaining consistent authentication state management across all application layers and demonstrates the necessity of comprehensive security testing for API and frontend components to prevent similar inconsistencies in session handling. This issue aligns with ATT&CK technique T1548.001 for privilege escalation and T1078 for valid accounts, as it allows continued access to user sessions through session token persistence despite logout operations.