CVE-2024-22408: Shopware Flow Builder SSRF Vulnerability

CVE-2024-22408 Overview

Shopware is an open headless commerce platform used by online retailers to manage storefronts and business workflows. CVE-2024-22408 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Flow Builder feature. The call webhook action fails to validate the target URL before dispatching outbound HTTP requests. Authenticated users with access to Flow Builder can point webhooks at internal hosts and reach services that are not exposed to the public network. Shopware fixed the issue in Commercial Plugin release 6.5.7.4 and provides a Security Plugin for older 6.4 and 6.5 branches.

Critical Impact
Authenticated attackers can pivot from the Shopware application to internal-only services, exposing metadata endpoints, admin panels, and other infrastructure not reachable from the internet.

Affected Products

Shopware Commercial versions prior to 6.5.7.4
Shopware 6.5 installations without the Security Plugin
Shopware 6.4 installations without the Security Plugin

Discovery Timeline

2024-01-16 - CVE-2024-22408 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22408

Vulnerability Analysis

The Flow Builder in Shopware lets merchants automate business processes by triggering actions on defined events. One available action, call webhook, sends an HTTP request to a user-supplied URL when the flow executes. The application accepts the URL without restricting the target host or protocol scheme.

An authenticated user who can configure a flow can supply an internal URL such as http://127.0.0.1, http://localhost:8080, or a cloud metadata endpoint like http://169.254.169.254/latest/meta-data/. When the flow fires, the Shopware backend performs the request server-side and can return response data or side effects to the attacker. This turns the commerce backend into a proxy for reaching internal services.

The vulnerability requires low-privilege authenticated access and no user interaction. Successful exploitation compromises confidentiality and integrity of internal systems reachable from the Shopware host.

Root Cause

The root cause is missing allowlist validation on the URL parameter of the call webhook action. The Flow Builder logic treats the URL as an opaque string and passes it directly to the HTTP client, without checking whether the resolved host is public, private, or link-local. Standard SSRF defenses such as DNS resolution checks, IP range filtering, and scheme restrictions were absent.

Attack Vector

An attacker with permission to create or edit flows creates a new automation, selects the call webhook action, and sets the URL to an internal address. Triggering the flow event causes the Shopware backend to issue the request. The attacker can enumerate internal services, retrieve cloud instance credentials from metadata APIs, or invoke unauthenticated internal endpoints. Refer to the Shopware GitHub Security Advisory GHSA-3535-m8vh-vrmw for vendor details.

Detection Methods for CVE-2024-22408

Indicators of Compromise

Outbound HTTP requests from the Shopware application host to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses
Requests originating from Shopware to cloud metadata endpoints such as 169.254.169.254
Unusual Flow Builder entries with webhook URLs pointing at non-public hosts
Unexpected HTTP response codes in Shopware application logs for webhook actions

Detection Strategies

Audit the flow and flow_sequence database tables for webhook actions targeting internal, loopback, or link-local addresses
Inspect web server and PHP-FPM egress logs for connections that violate expected external-only patterns
Correlate administrator authentication events with subsequent Flow Builder configuration changes

Monitoring Recommendations

Enable egress filtering on the Shopware host and alert on blocked requests to RFC1918 space
Log all Flow Builder configuration changes with the acting user and reviewed URL values
Monitor calls to cloud provider metadata services from application workloads

How to Mitigate CVE-2024-22408

Immediate Actions Required

Update the Shopware Commercial Plugin to version 6.5.7.4 or later
Install the Shopware Security Plugin on any 6.4 or 6.5 installation that cannot upgrade immediately
Review existing Flow Builder flows and remove webhook actions pointing at internal or unexpected hosts
Restrict Flow Builder permissions to trusted administrators only

Patch Information

Shopware addressed the SSRF in Commercial Plugin release 6.5.7.4. Equivalent protections are delivered through the Security Plugin for supported 6.4 and 6.5 branches. Upgrading to the latest Shopware version restores full functionality with the fix applied. See the vendor advisory for exact upgrade paths.

Workarounds

Deploy an egress proxy or firewall rule that blocks outbound traffic from the Shopware host to private and link-local IP ranges
Disable the Flow Builder call webhook action if it is not required for business operations
Use instance metadata service v2 (IMDSv2) on AWS to require session tokens and mitigate metadata exposure

bash

# Example iptables egress restriction blocking Shopware host access to internal ranges
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.0.0/16 -j REJECT