Colinmollenhour

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage Catalog Model Product Option Type File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin.

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute set columns of an import file to run script in the session of the administrator who imports it.

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vulnerability because Mage Api Model Session:: renewBySessId() never checks api user.is active and REST OAuth authorization never checks whether the admin user is active. Attackers holding an existing SOAP/XML-RPC session or OAuth access token retain API access after deactivation or API key rotation, reading and modifying customer, order and catalog data.

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability because admin controllers' isAllowed() checks fall back to, or only check, parent ACL resources instead of finer per-action permissions. Authenticated restricted administrators can mass cancel or hold orders, rewrite order shipping addresses, export customer report data, or create REST roles despite their role denying those permissions.

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with cart permissions can select free via cart payment.method while the total is zero, raise it with cart coupon.remove, and submit cart.order to place an unpaid full-price order.

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage Rss Model Resource Order::getAllCommentCollection(), which omits the is visible on front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes.

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because admin pages render Dataflow profile link variables, tax rate titles, OAuth consumer names, and PayPal certificate filenames without escaping. An administrator restricted to one affected area can store script that runs when another administrator, including a full administrator, opens the page, reading the form key and performing actions with that administrator's privileges.

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type and does not escape feed entry data, leading to stored cross-site scripting. An unauthenticated guest can submit a product review with script in the nickname, title or text that executes when an administrator opens the pending-reviews feed, enabling admin account takeover.

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage SalesRule Model Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows.

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a cross-site GET to paypal/standard/cancel to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart.

OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth callback URLs with a string-prefix check and falls back to accepting any well-formed URL. Attackers holding a leaked consumer key and secret can supply host-suffix, userinfo, or arbitrary callback URLs to capture an approving administrator's or customer's request token and verifier, then obtain an access token with the victim's API privileges.

OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/order/status feed because its URL key is unsigned Base64-encoded JSON of the order, increment, and customer ids. Unauthenticated attackers can forge keys from enumerated sequential ids to read other customers' names, items, prices, totals, and status comments when order-status RSS is enabled.

توجد ثغرة تسمح برفع ملفات غير مقيدة لأن قائمة الحظر `general/file/protected extensions` تغفل الامتدادات `phar` و `php8` و `phps`. يمكن للمهاجمين غير المصرح لهم رفع ملف `.phar` من خلال خيار ملف مخصص للمنتج إلى مسار `media/custom options` يمكن التنبؤ به. وفي حال كان الخادم يقوم بربط ملفات `.phar` بلغة PHP ويسمح بالوصول إلى ذلك المجلد، يمكن طلب الملف المرفوع مباشرة لتنفيذ تعليمات برمجية عشوائية.

يتم إنشاء مفاتيح تأكيد البريد الإلكتروني للعملاء باستخدام `md5(uniqid())` بينما تستخدم رموز إعادة تعيين كلمة مرور العملاء والمسؤولين دالة `uniqHash()` غير التشفيرية. يمكن للمهاجمين غير المصرح لهم تنفيذ هجوم القوة الغاشمة على مفتاح التأكيد الذي يبلغ طوله حوالي 20 بت عبر نقطة النهاية `confirmAction` التي تفتقر إلى تحديد معدل الطلبات، وذلك لتسجيل الدخول كعملاء معلقين. بالإضافة إلى ذلك، يمكن التنبؤ برموز إعادة تعيين المسؤول بعد استعادة حالة المولد.

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted configuration secrets because the store.getConfig email template directive's encrypted-path check missed config.xml-declared paths, case variants of the getConfig method name, and parent paths. Administrators with Transactional Emails access can preview a crafted template to expose PayPal, payment gateway, and carrier credentials.

توجد ثغرة تزوير الطلبات عبر المواقع (CSRF) في إجراءات تأكيد OAuth (confirm و confirmSimple) الخاصة بلوحة التحكم والمتجر. تقبل هذه الإجراءات طلبات GET دون التحقق من المتغير `form-key`. يمكن للمهاجم الذي يمتلك بيانات اعتماد مستهلك OAuth استدراج مسؤول أو عميل مسجل الدخول لزيارة رابط مصمم خصيصاً، مما يؤدي إلى تفويض رمز طلب المهاجم، والذي يمكن استبداله بعد ذلك عبر نقطة النهاية '/oauth/token' للحصول على رمز وصول دائم لواجهة برمجة تطبيقات REST API مرتبط بحساب الضحية.

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability because storefront MSRP/MAP popup and Qty Increments notice templates output product names without proper escaping. Attackers with admin product-edit rights can store a malicious product name that executes script when shoppers view product, category, or wishlist pages.

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerability in the template filter's {{layout}} directive, which renders arbitrary layout handles without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget or newsletter content can embed {{layout}} with arbitrary handles to render disallowed blocks and disclose limited information.

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT NAME from the request path, executing script in the storefront origin within victims' browsers.