Listen to this Post
The CVE-2021-21018 vulnerability in OpenMage works due to improper output escaping within the admin notification grid. Specifically, the file `app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php` contains two key flaws. First, the translation function `__()` used for link labels does not escape its output, allowing malicious script tags to be rendered. Second, the JavaScript function `deleteConfirm()` embeds a user-controlled message directly without sanitization. An attacker with administrative privileges can exploit this by injecting a malicious payload, either by modifying the locale translation files (e.g., app/locale/en_US/local.csv) or by polluting the admin notification data source. When an administrator views the System Notifications Inbox, the stored payload is executed in their browser, as the unescaped data is interpreted as HTML and JavaScript by the victim’s browser.
Platform: OpenMage LTS
Version: <=20.15.0
Vulnerability : Stored XSS
Severity: Medium
date: 2021-02-09
Prediction: Patch by 2021-03-15
What Undercode Say:
find app/code/core -name ".php" -exec grep -l "deleteConfirm" {} \;
grep -r "<strong>('" app/code/core/Mage/Adminhtml/Block/Notification/
// In Actions.php
echo $this-></strong>('Read Details');
echo "deleteConfirm('" . $this->__('Are you sure?') . "', ...)";
How Exploit:
Modify `local.csv` file.
Inject payload via admin feed.
Trigger via admin panel view.
Protection from this CVE
Escape all translation outputs.
Use `$this->escapeHtml()`.
Sanitize data for `deleteConfirm`.
Impact:
Admin account compromise.
Session hijacking.
Privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
