GHSA-gp6m-fq6h-cjcx: 
PHP vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability (CVE-2024-20717) was identified in OpenMage/Magento LTS, affecting versions 20.0.0 to 20.5.0 and versions prior to 19.5.3. The vulnerability was disclosed on February 27, 2024, and impacts the admin file form functionality where filenames are not properly escaped in certain situations (GitHub Advisory, Adobe Advisory).

The vulnerability exists in the Mage_Adminhtml_Block_System_Config_Form_Field_File component, which fails to properly escape filename values in specific scenarios. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Moderate), with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This indicates network vector attack capability, low attack complexity, required low privileges, and user interaction, with changed scope and low impacts on confidentiality and integrity (GitHub Advisory).

The vulnerability affects administrators who have access to any file upload field in the admin interface, both in core or custom implementations. When exploited, malicious JavaScript can be executed in a victim's browser when they navigate to pages containing the vulnerable field, potentially compromising admin session security (GitHub Advisory).

A proof of concept exists demonstrating the vulnerability exploitation. The attack involves creating an empty file with a malicious filename, navigating to System > Configuration > Sales | Payment Methods, configuring PayPal Express Checkout, selecting API Certificate from authentication methods, and choosing the malicious file. This results in both immediate and stored XSS execution (GitHub Advisory).

The vulnerability has been patched in versions 20.5.0 and 19.5.3. Users are advised to upgrade to these patched versions to mitigate the risk (GitHub Advisory).