GHSA-6vqf-6fhm-7rc6: OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module
The Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `..././` or `....//`, which after the replacement still result in `../`. An authenticated administrator can exploit this to read arbitrary files from the server filesystem.| Metric                   | Value     | Justification                         |
| ------------------------ | --------- | ------------------------------------- |
| Attack Vector (AV)       | Network   | Exploitable via admin panel           |
| Attack Complexity (AC)   | Low       | Simple bypass pattern                 |
| Privileges Required (PR) | High      | Requires admin authentication         |
| User Interaction (UI)    | None      | No additional user interaction needed |
| Scope (S)                | Unchanged | Impacts the vulnerable component      |
| Confidentiality (C)      | High      | Can read sensitive system files       |
| Integrity (I)            | None      | Read-only vulnerability               |
| Availability (A)         | None      | No impact on availability             |Affected ProductsOpenMage LTS versions < 20.16.1All versions derived from Magento 1.x with these code pathsAffected Files| File                                                         | Line | Vulnerable Code                          |
| ------------------------------------------------------------ | ---- | ---------------------------------------- |
| `app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php`   | 67   | `str_replace('../', '', urldecode(...))` |
| `app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php` | 63   | `str_replace('../', '', urldecode(...))` |Vulnerability DetailsThe Dataflow module allows administrators to import data from files. The `files` parameter specifies which file to import from the `var/import/` directory. To prevent path traversal, the code uses `str_replace()` to remove `../` sequences:However, `str_replace()` only performs a single pass, making it trivially bypassable:Bypass Examples| Input                          | After `str_replace('../', '', ...)` | Result    |
| ------------------------------ | ----------------------------------- | --------- |
| `..././`                       | `../`                               | Bypass    |
| `....//`                       | `../`                               | Bypass    |
| `..././..././..././etc/passwd` | `../../../etc/passwd`               | File read |Attack ScenarioAttacker gains admin access (via compromised credentials, social engineering, etc.)Navigate to System > Import/Export > Dataflow ProfilesCreate or modify an import profileSet the `files` parameter to: `..././..././..././etc/passwd`Run the profile to read the contents of `/etc/passwd`Proof of ConceptRemediationReplace the weak `str_replace()` filter with `basename()` to extract only the filename:Using `basename()` ensures only the filename portion is used, completely preventing any path traversal regardless of the input pattern.WorkaroundsIf immediate upgrade is not possible:**Restrict admin access**: Limit Dataflow access to trusted administrators only**Disable Dataflow**: If not in use, disable the Dataflow module entirely**Web Application Firewall**: Block requests containing path traversal patterns**File permissions**: Ensure the web server user has minimal filesystem permissions**Monitor admin activity**: Alert on suspicious Dataflow profile executionImpactAn attacker with admin access can read sensitive files including:`/etc/passwd` - System user information`app/etc/local.xml` - Database credentials`.env` files - Environment secretsLog files - Potentially sensitive application dataConfiguration files - Server and application configurationCreditThis vulnerability was discovered and responsibly disclosed by [blackhat2013](https://hackerone.com/blackhat2013) through HackerOne.Timeline**2025-12-31**: Vulnerability reported via HackerOne**2026-01-21**: Fix developed and tested
CVSS v3.1: 4.9