CVE-2021-32758 Layout XML Arbitrary Code Fix

What is CVE-2021-32758?

CVE-2021-32758 is a high-severity code injection vulnerability in OpenMage magento-lts, published on 27 Aug 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched.

Weakness: CWE-91

Which versions are affected by CVE-2021-32758?

4 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.

Products include Openmage Openmage.

How do I fix CVE-2021-32758?

Upgrade openmage/magento-lts to a fixed version for your release line: 19.4.15 or 20.0.13.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-32758 being exploited?

There is no known exploitation of CVE-2021-32758 in the wild and no public exploit code.

Other vulnerabilities in OpenMage magento-lts

• CVE-2020-26285 Widget instances allows a hacker to inject an executable file on the server on OpenMage High 8.7
• CVE-2020-26295 CMS Editor code execution High 8.7
• CVE-2020-26252 Layout XML RCE Vulnerability in OpenMage High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-26rr-v2j2-25fh.