Theroch

A cross-site request forgery issue exists in the admin and storefront OAuth confirm and confirmSimple actions. These actions accept GET requests without validating the `form-key` variable. An attacker possessing OAuth consumer credentials can trick an authenticated administrator or customer into visiting a specially crafted URL. This action authorizes the attacker's request token, which can then be exchanged at the '/oauth/token' endpoint for a persistent REST API access token linked to the victim's account.

The issue concerns the "guest-view" cookie in Magento LTS, which contains a 6 hexadecimal character protect code. This code is not sufficient to prevent brute-force attacks, allowing unauthorized access to guest orders. Each order would require a separate brute force attack to expose. The German Federal Office for Information Security found this flaw through a commissioned pen test, noting that the web application accepts certain requests without strong authentication if the person making the request has non-public but easily guessed data. Implementing rate-limiting at the web server, such as a strict rate limit for the specific route (`sales/guest/view/`), can help mitigate the issue.

This issue allows attackers to circumvent the `fromkey protection` in the Admin Interface, increasing the attack surface for Cross Site Request Forgery attacks.