GHSA-2jfg-wx75-5cc8: OpenMage magento-lts before 20.19.0 CSRF via PayPal Cancel Return Handlers
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a cross-site GET to paypal/standard/cancel to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Stores running OpenMage magento-lts before 20.19.0, or 21.0.0-beta releases before 21.0.0-beta3, are affected when shoppers have a recent uninvoiced order using the affected PayPal flow.
What does an attacker need to exploit it?
The attacker does not need privileges, but must lure a shopper into making a cross-site GET request to the PayPal Standard cancel handler. Exploitation also depends on the shopper having a recent uninvoiced order whose checkout session can be acted on.
What is the practical impact on an affected shopper's order?
The request can cancel the recent uninvoiced order, void pending payment authorizations, and return the order items to the shopper's cart.
What versions address the vulnerability?
Upgrade to OpenMage magento-lts 20.19.0 or later, or to 21.0.0-beta3 or later on the 21.0.0 beta line.