Stored XSS in OpenMage Magento-LTS via SVG/XHTML/XML File Uploads

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3. It allows unauthenticated attackers to upload malicious SVG, XHTML, or XML files via product File custom options with an empty allowed-extension list. When victims access the file URL under media/custom_options/, the script executes in the store's origin, potentially exposing administrator sessions if the admin panel shares the same origin.

Useful 0 Not Useful 0

Detection Guidance

Check for uploaded SVG, XHTML, or XML files in media/custom_options/ with empty allowed-extension lists. Inspect product File custom options for guest uploads. Review server logs for suspicious file access patterns.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can execute malicious scripts in the context of the store, leading to theft of sensitive data like session cookies, administrator credentials, or other confidential information. Victims may unknowingly trigger the script by visiting a crafted file URL, compromising their accounts or the store's security.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenMage magento-lts to version 20.18.2 or later (or 21.0.0-beta3). Disable guest uploads for File custom options. Restrict allowed file extensions to safe types. Monitor media/custom_options/ for unauthorized files.

Useful 0 Not Useful 0