GitHub Security Advisory: GHSA-665x-ppc4-685w
Package: openmage/magento-lts (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 20.17.0
Patched in: 20.17.0

Summary: OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure

Details:
# Cross-user wishlist item import via shared wishlist code, leading to private option disclosure and file-disclosure variant

## Summary

The shared wishlist add-to-cart endpoint authorizes access with a public `sharing_code`, but loads the acted-on wishlist item by a separate global `wishlist_item_id` and never verifies that the item belongs to the shared wishlist referenced by that code.

This lets an attacker use:

- a valid shared wishlist code for wishlist A
- a wishlist item ID belonging to victim wishlist B

to import victim item B into the attacker's cart through the shared wishlist flow for wishlist A.

Because the victim item's stored `buyRequest` is reused during cart import, the victim's private custom-option data is copied into the attacker's quote. If the product uses a file custom option, this can be elevated to cross-user file disclosure because the imported file metadata is preserved and the download endpoint is not ownership-bound.

## Vulnerability Type

- Broken object-level authorization / IDOR
- Cross-user data disclosure
- Cross-user file disclosure variant

## Root Cause

In `app/code/core/Mage/Wishlist/controllers/SharedController.php`, the shared flow does:

```php
$item = Mage::getModel('wishlist/item')->load($itemId);
$wishlist = Mage::getModel('wishlist/wishlist')->loadByCode($code);
...
$item->addToCart($cart);
```

Relevant lines:

- `SharedController.php:86` loads the wishlist item by global ID
- `SharedController.php:87` loads the wishlist by shared code
- `SharedController.php:99` imports the item into cart

There is no check that:

```php
$item->getWishlistId() == $wishlist->getId()
```

The safe owner flow in `app/code/core/Mage/Wishlist/controllers/IndexController.php:521-528` does preserve this binding by deriving the wishlist from `item->getWishlistId()`.

The imported item keeps its original `buyRequest` because `app/code/core/Mage/Wishlist/Model/Item.php:370-372` passes that stored request directly into:

```php
$cart->addProduct($product, $buyRequest);
```

## Security Impact

### Baseline impact

An attacker can import another user's private wishlist item into the attacker's own cart, using an unrelated shared wishlist code.

This is a clear cross-user authorization bypass. The victim item's private configuration is copied into the attacker's quote, including custom-option values such as personalized text.

### Stronger variant: cross-user file disclosure

If the victim item contains a custom option of type `file`, the imported quote item preserves file metadata such as:

- `quote_path`
- `order_path`
- `secret_key`

The file option renderer in `app/code/core/Mage/Catalog/Model/Product/Option/Type/File.php:547-552` generates a download URL from:

- the imported `sales/quote_item_option` ID
- the preserved `secret_key`

The downloader in `app/code/core/Mage/Sales/controllers/DownloadController.php:150-185`:

- loads quote item option by global ID
- verifies only product option type and `secret_key`
- read