Vulnerability: OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.
Vulnerability ID: CVE-2020-26252
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/OpenMage/magento-lts
Published: 2021-01-20
File: app/code/core/Mage/Core/Model/Layout.php
Commit message: Merge pull request from GHSA-99m6-r53j-4hh2

Fix for Layout XML RCE Vulnerability
Commit author: Mark Lewis

Vulnerable version (before fix):
 class Mage_Core_Model_Layout extends Varien_Simplexml_Config      */     protected $_directOutput = false;      /**      * Class constructor      * protected function _generateAction($node, $parent)                 }             }              $this->_translateLayoutNode($node, $args);             call_user_func_array(array($block, $method), array_values($args));         } protected function _generateAction($node, $parent)         return $this;     }      /**      * Translate layout node      *

Fixed version (after fix):
 class Mage_Core_Model_Layout extends Varien_Simplexml_Config      */     protected $_directOutput = false;      protected $invalidActions         = [             // explicitly not using class constant here Mage_Page_Block_Html_Topmenu_Renderer::class             // if the class does not exists it breaks.             ['block' => 'Mage_Page_Block_Html_Topmenu_Renderer', 'method' => 'render'],             ['block' => 'Mage_Core_Block_Template', 'method' => 'fetchview'],         ];      /**      * Class constructor      * protected function _generateAction($node, $parent)                 }             }              $this->validateAgainstBlacklist($block, $method, $args);              $this->_translateLayoutNode($node, $args);             call_user_func_array(array($block, $method), array_values($args));         } protected function _generateAction($node, $parent)         return $this;     }      /**      * @param Mage_Core_Block_Abstract $block      * @param string                   $method      * @param string[]                 $args      *      * @throws Mage_Core_Exception      */     protected function validateAgainstBlacklist(Mage_Core_Block_Abstract $block, $method, array $args)     {         foreach ($this->invalidActions as $action) {             if ($block instanceof $action['block'] && $action['method'] === strtolower($method)) {                 Mage::throwException(                     sprintf('Action with combination block %s and method %s is forbidden.', get_class($block), $method)                 );             }         }     }      /**      * Translate layout node      *

Patch:
patch: @@ -74,6 +74,14 @@ class Mage_Core_Model_Layout extends Varien_Simplexml_Config
      */
     protected $_directOutput = false;
 
+    protected $invalidActions
+        = [
+            // explicitly not using class constant here Mage_Page_Block_Html_Topmenu_Renderer::class
+            // if the class does not exists it breaks.
+            ['block' => 'Mage_Page_Block_Html_Topmenu_Renderer', 'method' => 'render'],
+            ['block' => 'Mage_Core_Block_Template', 'method' => 'fetchview'],
+        ];
+
     /**
      * Class constructor
      *
@@ -345,6 +353,8 @@ protected function _generateAction($node, $parent)
                 }
             }
 
+            $this->validateAgainstBlacklist($block, $method, $args);
+
             $this->_translateLayoutNode($node, $args);
             call_user_func_array(array($block, $method), array_values($args));
         }
@@ -354,6 +364,24 @@ protected function _generateAction($node, $parent)
         return $this;
     }
 
+    /**
+     * @param Mage_Core_Block_Abstract $block
+     * @param string                   $method
+     * @param string[]                 $args
+     *
+     * @throws Mage_Core_Exception
+     */
+    protected function validateAgainstBlacklist(Mage_Core_Block_Abstract $block, $method, array $args)
+    {
+        foreach ($this->invalidActions as $action) {
+            if ($block instanceof $action['block'] && $action['method'] === strtolower($method)) {
+                Mage::throwException(
+                    sprintf('Action with combination block %s and method %s is forbidden.', get_class($block), $method)
+                );
+            }
+        }
+    }
+
     /**
      * Translate layout node
      *
path: app/code/core/Mage/Core/Model/Layout.php