CVE-2026-42155— magento-lts 安全特征问题漏洞

Magento LTS: Weak API Session ID — Predictable MD5 of Time-Derived Inputs

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, the XML-RPC / SOAP API session ID is generated using an outdated, time-based construction rather than a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). All inputs to the MD5 hash are time-derived and non-secure. Because the resulting digest relies entirely on the timestamp and the PHP internal LCG state, the effective entropy is severely constrained. This violates the OWASP ASVS v4 requirement of ≥ 64 bits of entropy (V3.2.2) and NIST SP 800-63B standards. By narrowing the LCG window (via server state leaks or general predictability) and leveraging the lack of API rate-limiting, an attacker can generate a localized pool of candidate MD5 hashes and execute a high-speed online brute-force attack to hijack active API sessions. This vulnerability is fixed in 20.18.0.

N/A

使用不充分的随机数

magento-lts 安全特征问题漏洞

magento-lts是OpenMage开源的一个用于Magento CE官方版本的可靠替代品。 magento-lts 20.18.0之前版本存在安全特征问题漏洞，该漏洞源于XML-RPC/SOAP API会话ID使用基于时间的过时构造而非加密安全伪随机数生成器，所有MD5哈希输入均源自时间且不安全，有效熵严重受限，可能导致攻击者通过缩小LCG窗口并利用缺乏API速率限制，生成候选MD5哈希池并执行高速在线暴力攻击劫持活动API会话。

N/A

N/A