An unauthenticated arbitrary code execution vulnerability exists in OpenMage Magento LTS due to improper deserialization of untrusted data, posing a critical risk to e-commerce infrastructure.

The application utilizes PHP functions like getimagesize, file_exists, and is_readable on user-controllable paths, allowing an unauthenticated attacker to trigger deserialization using the phar stream wrapper. By uploading a malicious file disguised as an image, an attacker can achieve arbitrary code execution on the underlying server.

The vulnerability carries a CVSS score of 8.1, reflecting a high potential for total system compromise. Successful exploitation allows an attacker to gain full control over the e-commerce platform, leading to the theft of customer data, unauthorized transaction modifications, and significant reputational damage.

Immediate Action: Update OpenMage Magento LTS to version 20.17.0 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor server access logs for suspicious file upload patterns or requests containing phar stream wrapper strings in unexpected parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing phar:// strings and restrict file upload types to strictly validated image formats.

Public Exploit Available: Unknown

Given the critical nature of remote code execution vulnerabilities in e-commerce platforms, organizations must prioritize upgrading to version 20.17.0. Failure to patch this flaw leaves the application exposed to attackers who may leverage the publicly identified proof-of-concept to gain unauthorized access. Ensure that all staging environments are updated and tested before deploying the fix to production.