Critical Security Fix: Magento 2 Downloadable Links Vulnerable to Redirect Exploits

As e-commerce migration experts at Shopping Mover, we constantly monitor the Magento ecosystem for critical updates and insights that impact store security and performance. A recent GitHub issue (magento/magento2#41063) has brought to light a significant security vulnerability concerning Magento 2's downloadable product links, particularly affecting versions reported on 2.4.x. This issue, stemming from a proposed pull request (magento/magento2#41028), details how an oversight in redirect handling could lead to severe data exposure.

The Unseen Danger in Downloadable Links

Magento 2 allows merchants to offer downloadable products with links of type 'URL'. When these links are initially saved, their domains are validated against an allow list configured via downloadable:domains:add. However, the core of the vulnerability lies in how Magento's Downloadable\Helper\Download::setResource() method processes subsequent redirects. If the remote host returns a Location header, the helper follows this redirect and adopts the new target as the resource to fetch, critically, without re-validating it against the allow list. This 'first-hop' validation failure creates a gaping security hole.

Alarming Attack Vectors: What's at Risk?

The implications of this vulnerability are twofold and highly concerning:

• Cloud Metadata Exposure: A malicious or compromised host on your allow list could issue a 302 redirect to internal cloud metadata endpoints, such as http://169.254.169.254/latest/meta-data/.... Because get_headers() follows redirects by default, the internal request would be made, potentially exposing sensitive server configuration or credentials.
• Local File Inclusion: Even more critically, a relative Location header, like /etc/passwd, could be returned. Without a scheme, the _getHandle() method passes an empty driver code, causing DriverPool::getDriver() to fall back to the local file driver. This allows arbitrary local files to be read directly off the server's disk.

In both scenarios, the contents are streamed back by the downloadable/download/sample controller, which is accessible even to guest users, making this a high-severity information disclosure vulnerability.

The Proposed Solution and How It Works

The fix, detailed in the associated pull request, addresses this by moving the validation logic to where the redirect is resolved – within the Downloadable\Helper\Download::setResource() method itself. The solution involves:

• Re-validating Redirect Targets: The same DomainValidator used during the initial save path is now applied to every redirect target.
• Disabling Initial Follow Location: The follow_location option is explicitly turned off during the initial fetch, ensuring no external requests are made before the redirect target is validated.

This ensures that only redirects staying within the approved domain allow list are processed, preventing unauthorized access.

Manual Testing Scenarios for Verification

The issue provides clear manual testing steps for developers to confirm the vulnerability and the effectiveness of the fix:

1. Add a controlled domain to the allow list:

   bin/magento downloadable:domains:add example.com

2. Create a downloadable product with a URL sample pointing to http://example.com/sample.zip.
3. Configure example.com/sample.zip to return a 302 redirect to http://169.254.169.254/latest/meta-data/. Verify that before the fix, metadata is downloaded; after, it's rejected.
4. Repeat the test with a redirect to a relative path like /etc/passwd. Confirm that before the fix, the local file is returned; after, the request is rejected.
5. Finally, confirm that legitimate redirects within the allowed domain (e.g., http://example.com/other.zip) continue to function correctly.

This detailed approach ensures comprehensive testing and confirms the robust nature of the proposed security patch.

Shopping Mover's Take

For merchants considering or undergoing a Magento migration, understanding such vulnerabilities is paramount. Ensuring your Magento 2 instance is fully patched and configured securely is a critical step in protecting your e-commerce operations. This issue highlights the continuous effort within the Magento community to enhance platform security, and it's a strong reminder for all users to stay updated with the latest security patches and best practices.