Information Exposure Through Timing Discrepancy in Shopware - #VU131956

Detailed vulnerability description

The vulnerability allows a remote attacker to enumerate administrator usernames.

The vulnerability exists due to observable timing discrepancy in getUserEntityByUserCredentials() in src/Core/Framework/Api/OAuth/UserRepository.php when handling authentication requests to api/oauth/token. A remote attacker can send authentication requests and measure response times to enumerate administrator usernames.

The issue occurs because requests for nonexistent usernames return earlier than requests for existing usernames that reach password verification.

Remediation

Sources

• https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw
• https://github.com/shopware/shopware/blob/trunk/src/Core/Framework/Api/OAuth/UserRepository.php