Fixes a bug in Zend Framework's Stream HTTP Wrapper

Vulnerability

The vulnerability exists in Magento-lts versions 19.4.12 and prior, and 20.0.8 and prior. It is caused by unsecured deserialization of an object, specifically in the Zend Framework's Zend_Http_Response_Stream component. The attacker abuses a feature that loads classes from objects to upload and execute malicious code on the server by manipulating the "callback" parameter. This is a backport of CVE-2021-3007 from Zend Framework 3 [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted request containing a malicious serialized object via the "callback" parameter. No authentication is required if the vulnerable endpoint is accessible. The attacker needs network access to the affected Magento-lts instance. The exploitation involves providing a "callbackOptions" array that instead contains malicious code, which is then deserialized and executed [2].

Impact

Successful exploitation allows an attacker to execute arbitrary PHP code on the server, leading to full remote code execution. This compromises the confidentiality, integrity, and availability of the Magento-lts application and its data. The attacker gains the ability to upload files, modify data, and potentially pivot to internal systems [1][2].

Mitigation

The vulnerability is patched in versions 19.4.13 and 20.0.9, released April 2021. Users should upgrade to these versions or later. No workaround is documented; upgrading is the recommended mitigation. The fix backports type checking from Zend Framework 3 to prevent deserialization of untrusted objects [1][2].