GitHub Security Advisory: GHSA-6vqf-6fhm-7rc6
Package: openmage/magento-lts (COMPOSER)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 20.17.0
Patched in: 20.17.0

Summary: OpenMage LTS has a Path Traversal Filter Bypass in Dataflow Module

Details:
The Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `..././` or `....//`, which after the replacement still result in `../`. An authenticated administrator can exploit this to read arbitrary files from the server filesystem.


| Metric                   | Value     | Justification                         |
| ------------------------ | --------- | ------------------------------------- |
| Attack Vector (AV)       | Network   | Exploitable via admin panel           |
| Attack Complexity (AC)   | Low       | Simple bypass pattern                 |
| Privileges Required (PR) | High      | Requires admin authentication         |
| User Interaction (UI)    | None      | No additional user interaction needed |
| Scope (S)                | Unchanged | Impacts the vulnerable component      |
| Confidentiality (C)      | High      | Can read sensitive system files       |
| Integrity (I)            | None      | Read-only vulnerability               |
| Availability (A)         | None      | No impact on availability             |

## Affected Products

- OpenMage LTS versions < 20.16.1
- All versions derived from Magento 1.x with these code paths

## Affected Files

| File                                                         | Line | Vulnerable Code                          |
| ------------------------------------------------------------ | ---- | ---------------------------------------- |
| `app/code/core/Mage/Dataflow/Model/Convert/Parser/Csv.php`   | 67   | `str_replace('../', '', urldecode(...))` |
| `app/code/core/Mage/Dataflow/Model/Convert/Parser/Xml/Excel.php` | 63   | `str_replace('../', '', urldecode(...))` |

## Vulnerability Details

The Dataflow module allows administrators to import data from files. The `files` parameter specifies which file to import from the `var/import/` directory. To prevent path traversal, the code uses `str_replace()` to remove `../` sequences:

```php
$file = Mage::app()->getConfig()->getTempVarDir() . '/import/'
    . str_replace('../', '', urldecode(Mage::app()->getRequest()->getParam('files')));
```

However, `str_replace()` only performs a single pass, making it trivially bypassable:

### Bypass Examples

| Input                          | After `str_replace('../', '', ...)` | Result    |
| ------------------------------ | ----------------------------------- | --------- |
| `..././`                       | `../`                               | Bypass    |
| `....//`                       | `../`                               | Bypass    |
| `..././..././..././etc/passwd` | `../../../etc/passwd`               | File read |

### Attack Scenario

1. Attacker gains admin access (via compromised credentials, social engineering, etc.)
2. Navigate to System > Import/Export > Dataflow Profiles
3. Create or modify an import profile
4. Set the `files` parameter to: `..././..././..././etc/passw