Deserialization of Untrusted Data Affecting openmage/magento-lts package, versions <20.17.0

openmage/magento-lts is a This repository is the home of an unofficial community-driven project.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data the Varien_Image file handling path and related image validation code in Varien_Image, Mage_Core_Model_File_Validator_Image, and Mage_Cms_Model_Wysiwyg_Images_Storage. An attacker can trigger object deserialization and execute attacker-controlled gadget chains by supplying a phar:// image path or upload target that is processed as an image. This can lead to remote code execution in deployments that accept untrusted image paths or files, exposing the application and its data to takeover.

Workarounds

• Disable the phar stream wrapper in PHP if your deployment does not need it, for example, by calling stream_wrapper_unregister('phar') during bootstrap; this prevents phar:// paths from triggering PHAR metadata deserialization in image and file checks.
• Reject or block phar:// paths at your application boundary before they reach image validation or media handling; this prevents attacker-controlled phar:// image paths from reaching functions like getimagesize(), file_exists(), and is_readable().
• Remove ICO uploads from your allowed image types and do not accept new .ico image files; this reduces the polyglot upload vector that can be used to smuggle PHAR content through image handling.

Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like Remote Method Invocation (RMI), Java Management Extension (JMX), Java Messaging System (JMS), Action Message Format (AMF), Java Server Faces (JSF) ViewState, etc.

Deserialization of untrusted data (CWE-502) is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, thus allowing the attacker to control the state or the flow of the execution.

• GitHub Commit
• GitHub Release
• Maintainer's Advisory