Stored XSS in OpenMage Magento-LTS Dataflow Profile

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OpenMage Magento-LTS versions before 20.18.2 and 21.0.0-beta1 to 21.0.0-beta3. It exists in the Dataflow batch import feature where error messages from product imports are displayed as HTML without proper escaping. Attackers can craft malicious import files with script code in fields like store, type, or attribute_set. When an administrator imports the file, the script executes in the admin panel with the administrator's session and privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect import files for malicious markup in store, type, or attribute_set columns. Check for unescaped HTML in error messages during Dataflow profile runs. Review admin session logs for unexpected script execution after file imports.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can exploit this to run malicious scripts in the session of an administrator who imports a crafted file. This could lead to session hijacking, unauthorized actions in the admin panel, or theft of sensitive data like credentials or customer information. The impact depends on the administrator's privileges and the store's configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance violations, fines, or reputational damage if exploited. Proper patching and access controls are critical to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade OpenMage Magento-LTS to versions 20.18.2, 20.19.0, or 21.0.0-beta3 or later.
• Only import files from trusted sources and inspect them for malicious markup before import.
• Disable the Dataflow batch import feature if not required.

Useful 0 Not Useful 0