Shopware Customer Orders can be canceled, even if refunds are disabled
The advisory, in context
Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller):
https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98
https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php
To mitigate this, a check should be added to the CancelOrderRoute which verifies that the feature is enabled.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 6.7.0.0 before 6.7.3.1
Fixed in 6.7.3.1
9 explicitly affected versions
v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.7.0.0"
},
{
"fixed": "6.7.3.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v6.7.0.0",
"v6.7.0.1",
"v6.7.1.0",
"v6.7.1.1",
"v6.7.1.2",
"v6.7.2.0",
"v6.7.2.1",
"v6.7.2.2",
"v6.7.3.0"
]
}Earlier releases before 6.6.10.7
Fixed in 6.6.10.7
155 explicitly affected versions
6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.10.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.3.0.0",
"6.3.0.1",
"6.3.0.2",
"6.3.1.0",
"6.3.1.1",
"6.3.2.0",
"6.3.2.1",
"6.3.3.0",
"6.3.3.1",
"6.3.4.0",
"6.3.4.1",
"6.3.5.0",
"6.3.5.1",
"6.3.5.2",
"6.3.5.3",
"6.3.5.4",
"6.4.0.0",
"6.4.0.0-RC1",
"6.4.1.0",
"6.4.1.1",
"6.4.1.2",
"6.4.10.0",
"6.4.10.1",
"6.4.11.0",
"6.4.11.1",
"6.4.12.0",
"6.4.13.0",
"6.4.14.0",
"6.4.15.0",
"6.4.15.1",
"6.4.15.2",
"6.4.16.0",
"6.4.16.1",
"6.4.17.0",
"6.4.17.1",
"6.4.17.2",
"6.4.18.0",
"6.4.18.1",
"6.4.19.0",
"6.4.2.0",
"6.4.2.1",
"6.4.20.0",
"6.4.20.1",
"6.4.20.2",
"6.4.3.0",
"6.4.3.1",
"6.4.4.0",
"6.4.4.1",
"6.4.5.0",
"6.4.5.1",
"6.4.6.0",
"6.4.6.1",
"6.4.7.0",
"6.4.8.0",
"6.4.8.1",
"6.4.8.2",
"6.4.9.0",
"6.5.0.0",
"6.5.0.0-rc1",
"6.5.0.0-rc2",
"6.5.0.0-rc3",
"6.5.0.0-rc4",
"v6.0.0+ea2",
"v6.1.0",
"v6.1.0-rc1",
"v6.1.0-rc2",
"v6.1.0-rc3",
"v6.1.0-rc4",
"v6.1.1",
"v6.1.2",
"v6.1.3",
"v6.1.4",
"v6.1.5",
"v6.1.6",
"v6.2.0",
"v6.2.0-RC1",
"v6.2.1",
"v6.2.2",
"v6.2.3",
"v6.5.1.0",
"v6.5.1.1",
"v6.5.2.0",
"v6.5.2.1",
"v6.5.3.0",
"v6.5.3.1",
"v6.5.3.2",
"v6.5.3.3",
"v6.5.4.0",
"v6.5.4.1",
"v6.5.5.0",
"v6.5.5.1",
"v6.5.5.2",
"v6.5.6.0",
"v6.5.6.1",
"v6.5.7.0",
"v6.5.7.1",
"v6.5.7.2",
"v6.5.7.3",
"v6.5.7.4",
"v6.5.8.0",
"v6.5.8.1",
"v6.5.8.10",
"v6.5.8.11",
"v6.5.8.12",
"v6.5.8.13",
"v6.5.8.14",
"v6.5.8.15",
"v6.5.8.16",
"v6.5.8.17",
"v6.5.8.18",
"v6.5.8.19",
"v6.5.8.2",
"v6.5.8.3",
"v6.5.8.4",
"v6.5.8.5",
"v6.5.8.6",
"v6.5.8.7",
"v6.5.8.8",
"v6.5.8.9",
"v6.6.0.0",
"v6.6.0.0-rc1",
"v6.6.0.0-rc2",
"v6.6.0.0-rc3",
"v6.6.0.0-rc4",
"v6.6.0.0-rc5",
"v6.6.0.0-rc6",
"v6.6.0.0-rc7",
"v6.6.0.1",
"v6.6.0.2",
"v6.6.0.3",
"v6.6.1.0",
"v6.6.1.1",
"v6.6.1.2",
"v6.6.10.0",
"v6.6.10.1",
"v6.6.10.2",
"v6.6.10.3",
"v6.6.10.4",
"v6.6.10.5",
"v6.6.10.6",
"v6.6.2.0",
"v6.6.3.0",
"v6.6.3.1",
"v6.6.4.0",
"v6.6.4.1",
"v6.6.5.0",
"v6.6.5.1",
"v6.6.6.0",
"v6.6.6.1",
"v6.6.7.0",
"v6.6.7.1",
"v6.6.8.0",
"v6.6.8.1",
"v6.6.8.2",
"v6.6.9.0"
]
}From 6.7.0.0 before 6.7.3.1
Fixed in 6.7.3.1
9 explicitly affected versions
v6.7.0.0, v6.7.0.1, v6.7.1.0, v6.7.1.1, v6.7.1.2, v6.7.2.0, v6.7.2.1, v6.7.2.2, v6.7.3.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.7.0.0"
},
{
"fixed": "6.7.3.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v6.7.0.0",
"v6.7.0.1",
"v6.7.1.0",
"v6.7.1.1",
"v6.7.1.2",
"v6.7.2.0",
"v6.7.2.1",
"v6.7.2.2",
"v6.7.3.0"
]
}Earlier releases before 6.6.10.7
Fixed in 6.6.10.7
155 explicitly affected versions
6.3.0.0, 6.3.0.1, 6.3.0.2, 6.3.1.0, 6.3.1.1, 6.3.2.0, 6.3.2.1, 6.3.3.0, 6.3.3.1, 6.3.4.0, 6.3.4.1, 6.3.5.0, 6.3.5.1, 6.3.5.2, 6.3.5.3, 6.3.5.4, 6.4.0.0, 6.4.0.0-RC1, 6.4.1.0, 6.4.1.1, 6.4.1.2, 6.4.10.0, 6.4.10.1, 6.4.11.0, 6.4.11.1, 6.4.12.0, 6.4.13.0, 6.4.14.0, 6.4.15.0, 6.4.15.1, 6.4.15.2, 6.4.16.0, 6.4.16.1, 6.4.17.0, 6.4.17.1, 6.4.17.2, 6.4.18.0, 6.4.18.1, 6.4.19.0, 6.4.2.0, 6.4.2.1, 6.4.20.0, 6.4.20.1, 6.4.20.2, 6.4.3.0, 6.4.3.1, 6.4.4.0, 6.4.4.1, 6.4.5.0, 6.4.5.1, 6.4.6.0, 6.4.6.1, 6.4.7.0, 6.4.8.0, 6.4.8.1, 6.4.8.2, 6.4.9.0, 6.5.0.0, 6.5.0.0-rc1, 6.5.0.0-rc2, 6.5.0.0-rc3, 6.5.0.0-rc4, v6.0.0+ea2, v6.1.0, v6.1.0-rc1, v6.1.0-rc2, v6.1.0-rc3, v6.1.0-rc4, v6.1.1, v6.1.2, v6.1.3, v6.1.4, v6.1.5, v6.1.6, v6.2.0, v6.2.0-RC1, v6.2.1, v6.2.2, v6.2.3, v6.5.1.0, v6.5.1.1, v6.5.2.0, v6.5.2.1, v6.5.3.0, v6.5.3.1, v6.5.3.2, v6.5.3.3, v6.5.4.0, v6.5.4.1, v6.5.5.0, v6.5.5.1, v6.5.5.2, v6.5.6.0, v6.5.6.1, v6.5.7.0, v6.5.7.1, v6.5.7.2, v6.5.7.3, v6.5.7.4, v6.5.8.0, v6.5.8.1, v6.5.8.10, v6.5.8.11, v6.5.8.12, v6.5.8.13, v6.5.8.14, v6.5.8.15, v6.5.8.16, v6.5.8.17, v6.5.8.18, v6.5.8.19, v6.5.8.2, v6.5.8.3, v6.5.8.4, v6.5.8.5, v6.5.8.6, v6.5.8.7, v6.5.8.8, v6.5.8.9, v6.6.0.0, v6.6.0.0-rc1, v6.6.0.0-rc2, v6.6.0.0-rc3, v6.6.0.0-rc4, v6.6.0.0-rc5, v6.6.0.0-rc6, v6.6.0.0-rc7, v6.6.0.1, v6.6.0.2, v6.6.0.3, v6.6.1.0, v6.6.1.1, v6.6.1.2, v6.6.10.0, v6.6.10.1, v6.6.10.2, v6.6.10.3, v6.6.10.4, v6.6.10.5, v6.6.10.6, v6.6.2.0, v6.6.3.0, v6.6.3.1, v6.6.4.0, v6.6.4.1, v6.6.5.0, v6.6.5.1, v6.6.6.0, v6.6.6.1, v6.6.7.0, v6.6.7.1, v6.6.8.0, v6.6.8.1, v6.6.8.2, v6.6.9.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.10.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"6.3.0.0",
"6.3.0.1",
"6.3.0.2",
"6.3.1.0",
"6.3.1.1",
"6.3.2.0",
"6.3.2.1",
"6.3.3.0",
"6.3.3.1",
"6.3.4.0",
"6.3.4.1",
"6.3.5.0",
"6.3.5.1",
"6.3.5.2",
"6.3.5.3",
"6.3.5.4",
"6.4.0.0",
"6.4.0.0-RC1",
"6.4.1.0",
"6.4.1.1",
"6.4.1.2",
"6.4.10.0",
"6.4.10.1",
"6.4.11.0",
"6.4.11.1",
"6.4.12.0",
"6.4.13.0",
"6.4.14.0",
"6.4.15.0",
"6.4.15.1",
"6.4.15.2",
"6.4.16.0",
"6.4.16.1",
"6.4.17.0",
"6.4.17.1",
"6.4.17.2",
"6.4.18.0",
"6.4.18.1",
"6.4.19.0",
"6.4.2.0",
"6.4.2.1",
"6.4.20.0",
"6.4.20.1",
"6.4.20.2",
"6.4.3.0",
"6.4.3.1",
"6.4.4.0",
"6.4.4.1",
"6.4.5.0",
"6.4.5.1",
"6.4.6.0",
"6.4.6.1",
"6.4.7.0",
"6.4.8.0",
"6.4.8.1",
"6.4.8.2",
"6.4.9.0",
"6.5.0.0",
"6.5.0.0-rc1",
"6.5.0.0-rc2",
"6.5.0.0-rc3",
"6.5.0.0-rc4",
"v6.0.0+ea2",
"v6.1.0",
"v6.1.0-rc1",
"v6.1.0-rc2",
"v6.1.0-rc3",
"v6.1.0-rc4",
"v6.1.1",
"v6.1.2",
"v6.1.3",
"v6.1.4",
"v6.1.5",
"v6.1.6",
"v6.2.0",
"v6.2.0-RC1",
"v6.2.1",
"v6.2.2",
"v6.2.3",
"v6.5.1.0",
"v6.5.1.1",
"v6.5.2.0",
"v6.5.2.1",
"v6.5.3.0",
"v6.5.3.1",
"v6.5.3.2",
"v6.5.3.3",
"v6.5.4.0",
"v6.5.4.1",
"v6.5.5.0",
"v6.5.5.1",
"v6.5.5.2",
"v6.5.6.0",
"v6.5.6.1",
"v6.5.7.0",
"v6.5.7.1",
"v6.5.7.2",
"v6.5.7.3",
"v6.5.7.4",
"v6.5.8.0",
"v6.5.8.1",
"v6.5.8.10",
"v6.5.8.11",
"v6.5.8.12",
"v6.5.8.13",
"v6.5.8.14",
"v6.5.8.15",
"v6.5.8.16",
"v6.5.8.17",
"v6.5.8.18",
"v6.5.8.19",
"v6.5.8.2",
"v6.5.8.3",
"v6.5.8.4",
"v6.5.8.5",
"v6.5.8.6",
"v6.5.8.7",
"v6.5.8.8",
"v6.5.8.9",
"v6.6.0.0",
"v6.6.0.0-rc1",
"v6.6.0.0-rc2",
"v6.6.0.0-rc3",
"v6.6.0.0-rc4",
"v6.6.0.0-rc5",
"v6.6.0.0-rc6",
"v6.6.0.0-rc7",
"v6.6.0.1",
"v6.6.0.2",
"v6.6.0.3",
"v6.6.1.0",
"v6.6.1.1",
"v6.6.1.2",
"v6.6.10.0",
"v6.6.10.1",
"v6.6.10.2",
"v6.6.10.3",
"v6.6.10.4",
"v6.6.10.5",
"v6.6.10.6",
"v6.6.2.0",
"v6.6.3.0",
"v6.6.3.1",
"v6.6.4.0",
"v6.6.4.1",
"v6.6.5.0",
"v6.6.5.1",
"v6.6.6.0",
"v6.6.6.1",
"v6.6.7.0",
"v6.6.7.1",
"v6.6.8.0",
"v6.6.8.1",
"v6.6.8.2",
"v6.6.9.0"
]
}