Cross-Site Request Forgery in OpenMage Magento LTS

Executive Summary

This is a critical cross-site request forgery (CSRF) vulnerability in OpenMage Magento LTS versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3. It affects OAuth authorization confirm and confirmSimple actions in both admin and storefront areas. Attackers with OAuth consumer credentials can trick a logged-in user into visiting a malicious URL that authorizes the attacker's request token. The victim's browser then unknowingly sends a GET request to confirm the token, which the attacker can later exchange at /oauth/token for a persistent REST API access token tied to the victim's account.

The flaw exists because these OAuth actions accept GET requests without form-key validation, allowing unauthorized token authorization. The vulnerability has a CVSS score of 9.4 (Critical).

Useful 0 Not Useful 0

Detection Guidance

Check OpenMage Magento LTS versions before 20.18.2 or 21.0.0-beta1 to 21.0.0-beta2. Review server logs for suspicious GET requests to /oauth/token or OAuth confirm endpoints. Inspect network traffic for unauthorized token exchanges or REST API access attempts.

Useful 0 Not Useful 0

Impact Analysis

If you are an administrator or customer using OpenMage Magento LTS before 20.18.2 or 21.0.0-beta1, an attacker could gain unauthorized access to your account. They can obtain a persistent REST API access token bound to your session, allowing them to perform actions on your behalf without your knowledge. This includes accessing sensitive data, modifying settings, or performing administrative tasks if you have the necessary REST role assigned.

The attack requires the attacker to have OAuth consumer credentials and trick you into clicking a malicious link. Once authorized, the attacker can exchange the token for a valid API token that persists until revoked.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. If an attacker gains access to personal or health data through this flaw, it may result in non-compliance with data protection regulations, leading to legal penalties, reputational damage, and loss of trust. Organizations using affected versions must patch immediately to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to OpenMage Magento LTS 20.18.2 or 21.0.0-beta3 or later. Disable OAuth consumers if REST API is unused. Revoke untrusted consumers and restrict admin access. Ensure POST requests with form keys are enforced for OAuth authorization.

Useful 0 Not Useful 0