GitHub Security Advisory: GHSA-2cwr-gcf9-pvxr
Package: openmage/magento-lts (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-330: Use of Insufficiently Random Values, CWE-331: Insufficient Entropy, CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Vulnerable versions: <= 20.17.0
Patched in: 20.18.0

Summary: Magento LTS has Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Details:
Affected Version: OpenMage LTS ≤ 20.16.0 (confirmed on `20.16.0`)

Affected File: `https://github.com/OpenMage/magento-lts/blob/main/app/code/core/Mage/Api/Model/Session.php` – `start()` method


## Summary

The XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG):

```php
The XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG):
```
All inputs to the MD5 hash are time-derived and non-secure:

| Input                      | Value                                             | Predictability                         |
|----------------------------|---------------------------------------------------|----------------------------------------|
| `time()`                   | Unix timestamp (seconds)                          | Fully predictable                      |
| `uniqid('', true) prefix`  | `sprintf('%08x%05x', $sec, $usec/10)`             | Highly predictable via network timing  |
| `uniqid('', true) suffix`  | `php_combined_lcg()` decimal float                | Process-state dependent (`getpid() ^ time()`) |
| `$sessionName`             | `null` (empty) — called without arg               | Constant                               |

Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely constrained. This violates the OWASP ASVS v4 requirement of ≥ 64 bits of entropy (V3.2.2) and NIST SP 800-63B standards. By narrowing the LCG window (via server state leaks or general predictability) and leveraging the lack of API rate-limiting, an attacker can generate a localized pool of candidate MD5 hashes and execute a high-speed online brute-force attack to hijack active API sessions.



## Technical Analysis

### Code Path

```
POST /api/xmlrpc/ → login(username, apiKey)
  → Mage_Api_Model_Session::login()
      → $session->init('api', 'api')
          → Mage_Api_Model_Session::init($namespace='api', $sessionName='api')
              # $sessionName is NOT forwarded to start()
              → Mage_Api_Model_Session::start()  ← NO $sessionName argument
                  # $sessionName = null inside start()
                  $this->_currentSessId = md5(time() . uniqid('', true) . null)

```

Note: `init()` receives `$sessionName='api'` but invokes `$this->start()` without forwarding it, meaning the effective construction is strictly `md5(time() . uniqid('', true))`.

## Live Evidence
Five consecutive XML-RPC login tokens were collected from a live OpenMage 20.16.0 container, all generated within a single Unix second (`unix_sec= [PII_REDACTED]`):
```
Sample 1: 6a302397f17e48845d0f9aba377f3dc3  (usec ≈ 464631)
Sample 2: 39b4ec42bd3c389312e500690daeb349  (usec ≈ 497215)
Sample 3: 527662d79f7fb499597a82d80d170a88  (usec ≈ 535175)
Sample 4: e5d6f7a8906a03ea7af99d92be11b5b2  (use