Incorrect Authorization in OpenMage Magento-LTS via Layout Directive

Executive Summary

OpenMage magento-lts versions before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 have an authorization flaw in the template filter's {{layout}} directive. This allows arbitrary layout handles to be rendered without enforcing the admin/block whitelist that the {{block}} directive applies. Administrators with rights to edit email, CMS, widget, or newsletter content can exploit this to render disallowed blocks and disclose limited information.

Useful 0 Not Useful 0

Impact Analysis

If you are an administrator with editing rights for email, CMS, widget, or newsletter content, an attacker could exploit this to render unauthorized blocks and potentially access limited sensitive information. The impact is restricted to information disclosure and does not allow full system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR or HIPAA if personal or health information is exposed. Organizations must ensure proper access controls and patch systems to mitigate risks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenMage magento-lts to version 20.19.0 or later, or 21.0.0-beta3 or later to address the authorization flaw in the {{layout}} directive.

Useful 0 Not Useful 0