Description
OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenMage | magento-lts | 20.17.0 – < 20.18.2, 21.0.0-beta1 – < 21.0.0-beta3 | 20.18.2 |
References
- GitHub Security Advisory (GHSA-4fxg-469f-r6fc) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options third-party-advisory