SEC Consult SA-20210210-0 :: Reflected Cross-Site Scripting in Adobe Magento Commerce

--===============9059074791444303357==
Content-Type: multipart/signed; protocol="application/pkcs7-signature";
	micalg=sha-256; boundary="------------ms020807040500080202020708"

--------------ms020807040500080202020708
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

SEC Consult Vulnerability Lab Security Advisory < 20210210-0 >
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
              title: Reflected Cross-Site Scripting (XSS)
            product: Adobe Magento Commerce
 vulnerable version: < 2.4.2
      fixed version: 2.4.2
         CVE number: CVE-2021-21029
             impact: Medium
           homepage: https://magento.com/
              found: 2020-06-29
                 by: Natsasit Jirathammanuwat (Office Thailand)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult, an Atos company
                     Europe | Asia | North America

                     https://www.sec-consult.com

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Vendor description:
-------------------
"Magento Commerce, offers a one-of-a-kind eCommerce solution with
enterprise power, unlimited scalability, and open-source flexibility
for B2C and B2B experiences. Magento allows you to create unique,
full-lifecycle customer experiences proven to generate more sales.
No matter what your company=E2=80=99s size or goals =E2=80=94 omnichannel=
, global
expansion, mobile =E2=80=94 Magento delivers everything you need for grow=
th
in an increasingly competitive market."

Source: https://magento.com/products


Business recommendation:
------------------------
Update to the latest version of Adobe Magento Commerce.

An in-depth security analysis performed by security professionals is high=
ly
advised, as the software may be affected from further security issues.


Vulnerability overview/description:
-----------------------------------
1) Reflected Cross-Site Scripting (XSS) (CVE-2021-21029)
This vulnerability allows an unauthenticated user to inject malicious
client side script into the URL and send to the victim. The browser may
redirect the victim (e.g. admin) to the frontend page when visiting the U=
RL,
the script will be executed after the victim visits the admin panel again=
=2E

This vulnerability has two different scenarios:
1. Security configuration "Add Secret Key to URLs" is enabled (default).
 - Admin panel path is required.
 - Key value (secret hash) in the URL is required.
 - User interaction is required (navigate back to the admin panel).

2. Security configuration "Add Secret Key to URLs" is disabled.
 - Admin panel path is required.
 - User interaction is required (navigate back to the admin panel).


Proof of concept:
-----------------
1) Reflected Cross-Site Scripting (XSS) (CVE-2021-21029)
The "file" parameter is vulnerable to reflected cross-site scripting
vulnerability. By sending the XSS payload in the Base64 encoded format
in the URL as follows:

1. Security configuration "Add Secret Key to URLs" is enabled (default).
URL format:
https://{baseURL}/{adminPath}/admin/system_design_theme/downloadCss/theme=
_id/{themeID}/file/{base64encoded_xss_payload}/key/{secret_hash}
Example URL:
https://127.0.0.1/index.php/admin/admin/system_design_theme/downloadCss/t=
heme_id/1/file/PHNjcmlwdD5hbGVydCgnWFNTIGJ5IFNFQyBDb25zdWx0Jyk8L3NjcmlwdD=
4%3D/key/0f5d20e8559bb6f45e4840ceb6231870f3a8fe122698b37c32ceabbb33595813=


2. Security configuration "Add Secret Key to URLs" is disabled.
URL format:
https://{baseURL}/{adminPath}/admin/system_design_theme/downloadCss/theme=
_id/{themeID}/file/{base64encoded_xss_payload}/
Example URL:
https://127.0.0.1/index.php/admin/admin/system_design_theme/downloadCss/t=
heme_id/1/file/PHNjcmlwdD5hbGVydCgnWFNTIGJ5IFNFQyBDb25zdWx0Jyk8L3NjcmlwdD=
4%3D/


Vulnerable / tested versions:
-----------------------------
Magento2 version 2.3.5-p1 has been tested, which was the latest version
available at the time of the test. Previous versions may also be affected=
=2E
Later versions until the patched version v2.4.2 are affected as well.


Vendor contact timeline:
------------------------
2020-07-09 | Contacting vendor through https://hackerone.com/magento.
2020-07-09 | The report is flagged as out-of-scope in hackerone.
2020-08-13 | Contacting vendor and requesting encryption key through psir=
[email protected].
2020-08-13 | Vendor provides PGP encryption key.
2020-08-14 | Sending encrypted advisory to the vendor.
2020-09-09 | Asking vendor for a status update.
2020-09-10 | Vendor is still investigating the issue.
2020-09-28 | Asking vendor for a status update.
2020-10-02 | Vendor is still investigating the issue.
2020-11-24 | Asking vendor for a status update.
2020-11-24 | Vendor is planing to fix the issue in next release.
2021-02-02 | Asking vendor for a status update and the release date.
2021-02-02 | Vendor is planing to release a security update on February 9=
th.
2021-02-10 | Coordinated release of security advisory.


Solution:
---------
Update to the latest available version v2.4.2 of Magento2 from the vendor=
's download
page:
https://magento.com/tech-resources/download

Vendor security advisory:
https://helpx.adobe.com/security/products/magento/apsb21-08.html


Workaround:
-----------
None


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult, an Atos company
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, a=
n
Atos company. It ensures the continued knowledge gain of SEC Consult in t=
he
field of network and application security to stay ahead of the attacker. =
The
SEC Consult Vulnerability Lab supports high-quality penetration testing a=
nd
the evaluation of new offensive and defensive technologies for our custom=
ers.
Hence our customers obtain the most current information about vulnerabili=
ties
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consu=
lt?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF N. Jirathammanuwat / @2021


--------------ms020807040500080202020708
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
DGAwggYQMIID+KADAgECAhBNlCwQ1DvglAnFgS06KwZPMA0GCSqGSIb3DQEBDAUAMIGIMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkx
HjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRydXN0IFJT
QSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0xODExMDIwMDAwMDBaFw0zMDEyMzEyMzU5
NTlaMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYD
VQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3Rp
Z28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyjztlApB/975Rrno1jvm2pK/KxBOqhq8gr2+
JhwpKirSzZxQgT9tlC7zl6hn1fXjSo5MqXUfItMltrMaXqcESJuK8dtK56NCSrq4iDKaKq9N
xOXFmqXX2zN8HHGjQ2b2Xv0v1L5Nk1MQPKA19xeWQcpGEGFUUd0kN+oHox+L9aV1rjfNiCj3
bJk6kJaOPabPi2503nn/ITX5e8WfPnGw4VuZ79Khj1YBrf24k5Ee1sLTHsLtpiK9OjG4iQRB
dq6Z/TlVx/hGAez5h36bBJMxqdHLpdwIUkTqT8se3ed0PewDch/8kHPo5fZl5u1B0ecpq/sD
N/5sCG52Ds+QU5O5EwIDAQABo4IBZDCCAWAwHwYDVR0jBBgwFoAUU3m/WqorSs9UgOHYm8Cd
8rIDZsswHQYDVR0OBBYEFAnA8vwL2pTbX/4r36iZQs/J4K0AMA4GA1UdDwEB/wQEAwIBhjAS
BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDARBgNV
HSAECjAIMAYGBFUdIAAwUAYDVR0fBEkwRzBFoEOgQYY/aHR0cDovL2NybC51c2VydHJ1c3Qu
Y29tL1VTRVJUcnVzdFJTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHYGCCsGAQUFBwEB
BGowaDA/BggrBgEFBQcwAoYzaHR0cDovL2NydC51c2VydHJ1c3QuY29tL1VTRVJUcnVzdFJT
QUFkZFRydXN0Q0EuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC51c2VydHJ1c3QuY29t
MA0GCSqGSIb3DQEBDAUAA4ICAQBBRHUAqznCFfXejpVtMnFojADdF9d6HBA4kMjjsb0XMZHz
tuOCtKF+xswhh2GqkW5JQrM8zVlU+A2VP72Ky2nlRA1GwmIPgou74TZ/XTarHG8zdMSgaDrk
VYzz1g3nIVO9IHk96VwsacIvBF8JfqIs+8aWH2PfSUrNxP6Ys7U0sZYx4rXD6+cqFq/ZW5BU
fClN/rhk2ddQXyn7kkmka2RQb9d90nmNHdgKrwfQ49mQ2hWQNDkJJIXwKjYA6VUR/fZUFeCU
isdDe/0ABLTI+jheXUV1eoYV7lNwNBKpeHdNuO6Aacb533JlfeUHxvBz9OfYWUiXu09sMAvi
M11Q0DuMZ5760CdO2VnpsXP4KxaYIhvqPqUMWqRdWyn7crItNkZeroXaecG03i3mM7dkiPaC
kgocBg0EBYsbZDZ8bsG3a08LwEsL1Ygz3SBsyECa0waq4hOf/Z85F2w2ZpXfP+w8q4ifwO90
SGZZV+HR/Jh6rEaVPDRF/CEGVqR1hiuQOZ1YL5ezMTX0ZSLwrymUE0pwi/KDaiYB15uswgeI
AcA6JzPFf9pLkAFFWs1QNyN++niFhsM47qodx/PL+5jR87myx5uYdBEQkkDc+lKB1Wct6ucX
qm2EmsaQ0M95QjTmy+rDWjkDYdw3Ms6mSWE3Bn7i5ZgtwCLXgAIe5W8mybM2JzCCBkgwggUw
oAMCAQICEQCqEvWSMxa60FTK/mX98WsoMA0GCSqGSIb3DQEBCwUAMIGWMQswCQYDVQQGEwJH
QjEbMBkGA1UECBMSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYD
VQQKEw9TZWN0aWdvIExpbWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRo
ZW50aWNhdGlvbiBhbmQgU2VjdXJlIEVtYWlsIENBMB4XDTIwMDIxOTAwMDAwMFoXDTIzMDIx
ODIzNTk1OVowggFRMQswCQYDVQQGEwJBVDENMAsGA1UEERMEMjcwMDEWMBQGA1UECBMNTG93
ZXIgQXVzdHJpYTEVMBMGA1UEBxMMV3IuIE5ldXN0YWR0MRcwFQYDVQQJEw5Lb21hcmlnYXNz
ZSAxNDEuMCwGA1UEChMlU0VDIENvbnN1bHQgVW50ZXJuZWhtZW5zYmVyYXR1bmcgR21iSDFJ
MEcGA1UECxNASXNzdWVkIHRocm91Z2ggU0VDIENvbnN1bHQgVW50ZXJuZWhtZW5zYmVyYXR1
bmcgR21iSCBFLVBLSSBNYW5hZzEfMB0GA1UECxMWQ29ycG9yYXRlIFNlY3VyZSBFbWFpbDEm
MCQGA1UEAxMdU0VDIENvbnN1bHQgVnVsbmVyYWJpbGl0eSBMYWIxJzAlBgkqhkiG9w0BCQEW
GHJlc2VhcmNoQHNlYy1jb25zdWx0LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAMjhLLCjQCn+Gf7TyDcOlNIfQvq4jLeuo9LrBZLXOG4ccfndc/C+gWtIcub0rnzHF/F7
v+Ag636eDTLmECZUbAfPkNz7KNwXp8MpcnvMxMFIMmjODSjRZEla+cVOblNM9bVjJT7Lxt1j
bKzwDXxefF6EskGbJxqLcbAKJOE2CWK6KQBTyx6tXoi4Zmbqx5A0bt/vUOFansPvVOFqFh8s
WnHxqm/ASap5CsIpORcBeTmQlO0zCXgCiW72SaNfDLemVxo18Hx/O3i7juD8NR8NOL8tZCSV
JH+X12CAlfpDzPqx9JPZ+thPQ/e9DYTWIyGSP5zE80mpqSgBQLLVjAIDQfECAwEAAaOCAdEw
ggHNMB8GA1UdIwQYMBaAFAnA8vwL2pTbX/4r36iZQs/J4K0AMB0GA1UdDgQWBBSpYREAZ3TJ
TDKYmZRoqa17m9EH5zAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAU
BggrBgEFBQcDBAYIKwYBBQUHAwIwQAYDVR0gBDkwNzA1BgwrBgEEAbIxAQIBAQEwJTAjBggr
BgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdvLmNvbS9DUFMwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0
cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdvUlNBQ2xpZW50QXV0aGVudGljYXRpb25hbmRT
ZWN1cmVFbWFpbENBLmNybDCBigYIKwYBBQUHAQEEfjB8MFUGCCsGAQUFBzAChklodHRwOi8v
Y3J0LnNlY3RpZ28uY29tL1NlY3RpZ29SU0FDbGllbnRBdXRoZW50aWNhdGlvbmFuZFNlY3Vy
ZUVtYWlsQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTAjBgNV
HREEHDAagRhyZXNlYXJjaEBzZWMtY29uc3VsdC5jb20wDQYJKoZIhvcNAQELBQADggEBAG3h
PGEd6a0iPVOK7nEk+NigrOcYslK17zTVQSGnki/Nil1RcoC9k+eX5fIWDmFeqdMIwxjx2isV
mlXgph5sVc6QG4RcTvhaM9yhVbNrrw4vdv6jBJMghtU/jOwECryDXIwBEQ6RqHYLdAyo4ZFo
+ra9jpoTYfc81c3RAck2cwEq2yyXatFnEN1DRZ3oVLYg9cVkrDA3Af0UMv11TjawxHmyZyYY
2GGLiqTz0gsetS625bcD7gR2QfPiJ8L35PZg9SUgjPOSze3kwLEAbeOK4iJNmkPKpHrr5hh0
+4PZJaTcNwO5mRXxZFIRZfZ71kMZjAsG53a1ZHYnW5BJpMPYlBoxggQ1MIIEMQIBATCBrDCB
ljELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMH
U2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJT
QSBDbGllbnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAKoS9ZIzFrrQ
VMr+Zf3xaygwDQYJYIZIAWUDBAIBBQCgggJZMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw
HAYJKoZIhvcNAQkFMQ8XDTIxMDIxMDEzNTM0M1owLwYJKoZIhvcNAQkEMSIEIG9UaOC9RAt8
9CCl7UjTdYWhNptLQ0iyKLo0ljJAMs4XMGwGCSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEq
MAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwIC
AUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwgb0GCSsGAQQBgjcQBDGBrzCBrDCBljELMAkG
A1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9y
ZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMT4wPAYDVQQDEzVTZWN0aWdvIFJTQSBDbGll
bnQgQXV0aGVudGljYXRpb24gYW5kIFNlY3VyZSBFbWFpbCBDQQIRAKoS9ZIzFrrQVMr+Zf3x
aygwgb8GCyqGSIb3DQEJEAILMYGvoIGsMIGWMQswCQYDVQQGEwJHQjEbMBkGA1UECBMSR3Jl
YXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHEwdTYWxmb3JkMRgwFgYDVQQKEw9TZWN0aWdvIExp
bWl0ZWQxPjA8BgNVBAMTNVNlY3RpZ28gUlNBIENsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQg
U2VjdXJlIEVtYWlsIENBAhEAqhL1kjMWutBUyv5l/fFrKDANBgkqhkiG9w0BAQEFAASCAQBg
0btzkx0lkEHJ7UNaKRcE6S75rCCoZ0yQNa6nxp14xOu+8I5NPRgJ5cDsdxP01faHZTaFqFIi
0imRREIg+zvzmjmFkAm5/fQkMihu16d/h5oNhlOZy2htm2cjK668cM4O0AzYOKAAeuDBNiPK
ONOAoQavEGQQAwDh0x03b8wPtEs7jML2Otztn8HJRI0LXVpuGCMlURF6RL44r/xCFTzs9f6L
xWIA9IrggdWXitmXJMtsDc6ZgsWFshu0Oim2d2GhDFEI/VqPtb7XdmxkX2gfdQ0Q2ByPM7SP
u/peAO+48G7cDIUr1sNKBfB/MKCcMFd2MkB/7S3Jdxk8CMqQAbPKAAAAAAAA
--------------ms020807040500080202020708--

--===============9059074791444303357==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline