Sign In
Advisories

OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options

Go back
Severity
critical
Date
Affecting

  • magento-lts >= 20.17.0, < 20.18.2

  • magento-lts >= 21.0.0-beta1, < 21.0.0-beta3

CWE
  • CWE-184 Incomplete List of Disallowed Inputs
CVSS
9.2
CVSS V4 Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Credit
arpitjain099, 4n86rakam1, colinmollenhour, Hanmac
Description
OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo