CVE-2023-41879 (PHP, published 2023-09-11T22:15Z)
Description: value: Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-330 \u2014 Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Repository: https://github.com/OpenMage/magento-lts
Files changed:
app/code/core/Mage/Core/Helper/Data.php
app/code/core/Mage/Core/etc/config.xml
app/code/core/Mage/Core/etc/system.xml
app/code/core/Mage/Sales/Helper/Guest.php
app/code/core/Mage/Sales/Model/Order.php
app/locale/en_US/Mage_Core.csv
Commit message: Merge pull request from GHSA-9358-cpvx-c2qp

Co-authored-by: Fabrizio Balliano <fabrizio.balliano@gmail.com>

Vulnerable code:
        <!--<web_track translate="label" module="core">
            <label>Web Tracking</label>
            <sort_order>180</sort_order>
            <show_in_default>1</show_in_default>
            <show_in_website>1</show_in_website>
            <show_in_store>1</show_in_store>
        </web_track>-->
                <!--datashare translate="label">
                    <label>Datasharing</label>
                    <sort_order>1</sort_order>
                    <show_in_default>1</show_in_default>
                    <show_in_website>1</show_in_website>
                    <show_in_store>0</show_in_store>
                    <fields>
                        <default translate="label">
                            <label>Default</label>
                            <frontend_type>multiselect</frontend_type>
                            <backend_model>adminhtml/system_config_backend_datashare</backend_model>
                            <source_model>adminhtml/system_config_source_store</source_model>
                            <sort_order>1</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                        </default>
                        <default translate="label">
                            <label>Default</label>
                            <frontend_type>multiselect</frontend_type>
                            <backend_model>adminhtml/system_config_backend_datashare</backend_model>
                            <source_model>adminhtml/system_config_source_store</source_model>
                            <sort_order>1</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                        </default>
                    </fields>
                </datashare-->
        Mage::getSingleton('core/session')->addError($this->__($errorMessage));
            $this->setData('protect_code', substr(md5(uniqid(mt_rand(), true) . ':' . microtime(true)), 5, 6));

Fixed code:

    /**
     * @param bool $setErrorMessage Adds a predefined error message to the 'core/session' object
     * @return bool
     */
    public function isRateLimitExceeded($setErrorMessage = true, $recordRateLimitHit = true): bool
    {
        $active = Mage::getStoreConfigFlag('system/rate_limit/active');
        if ($active && $remoteAddr = Mage::helper('core/http')->getRemoteAddr()) {
            $cacheTag = 'rate_limit_' . $remoteAddr;
            if (Mage::app()->testCache($cacheTag)) {
                $errorMessage = "Too Soon: You are trying to perform this operation too frequently. Please wait a few seconds and try again.";
                Mage::getSingleton('core/session')->addError($this->__($errorMessage));
                return true;
            }

            if ($recordRateLimitHit) {
                $this->recordRateLimitHit();
            }
        }

        return false;
    }

    /**
     * @return void
     */
    public function recordRateLimitHit(): void
    {
        $active = Mage::getStoreConfigFlag('system/rate_limit/active');
        if ($active && $remoteAddr = Mage::helper('core/http')->getRemoteAddr()) {
            $cacheTag = 'rate_limit_' . $remoteAddr;
            Mage::app()->saveCache(1, $cacheTag, ['brute_force'], Mage::getStoreConfig('system/rate_limit/timeframe'));
        }
    }
            <rate_limit>
                <active>1</active>
                <timeframe>30</timeframe>
            </rate_limit>
                <rate_limit translate="label comment" module="core">
                    <label>Rate limit</label>
                    <sort_order>10</sort_order>
                    <show_in_default>1</show_in_default>
                    <show_in_website>1</show_in_website>
                    <show_in_store>1</show_in_store>
                    <comment>This functionality limits the number of requests a user (identified by IP address) can perform within a specific time frame, preventing excessive resources usage and maintaining system performance, stability and security.</comment>
                    <fields>
                        <active translate="label">
                            <label>Enabled</label>
                            <frontend_type>select</frontend_type>
                            <source_model>adminhtml/system_config_source_yesno</source_model>
                            <sort_order>10</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                        </active>
                        <timeframe translate="label comment">
                            <label>Timeframe</label>
                            <sort_order>20</sort_order>
                            <show_in_default>1</show_in_default>
                            <show_in_website>1</show_in_website>
                            <show_in_store>1</show_in_store>
                            <comment>Number of seconds between each allowed request.</comment>
                        </timeframe>
                    </fields>
                </rate_limit>
                Mage::helper('core')->recordRateLimitHit();
        if (!Mage::helper('core')->isRateLimitExceeded(true, false)) {
            Mage::getSingleton('core/session')->addError($this->__($errorMessage));
        }

            $this->setData('protect_code', Mage::helper('core')->getRandomString(16));
"Too Soon: You are trying to perform this operation too frequently. Please wait a few seconds and try again.","Too Soon: You are trying to perform this operation too frequently. Please wait a few seconds and try again."