Magento and Adobe Commerce Zero-Day 'StyleSmuggler' Actively Exploited, Leading to Store Backdoors
A critical zero-day vulnerability, dubbed StyleSmuggler, is being actively exploited in unpatched Magento Open Source and Adobe Commerce platforms, allowing unauthenticated attackers to execute arbitrary code and backdoor e-commerce stores.
E-commerce platforms running Magento Open Source and Adobe Commerce are under active attack due to a newly discovered zero-day vulnerability named StyleSmuggler. Dutch security firm Sansec reported that exploitation began on September 4th, with attackers successfully compromising online stores by executing arbitrary code on their servers without requiring any authentication. This vulnerability poses an immediate threat to businesses relying on these platforms for their online sales.
Sansec, which discovered the flaw, has emphasized the urgency of the situation, stating that stores are being compromised in real-time. As of September 6th, Adobe had not yet released an official advisory, a CVE identifier, or a patch for the vulnerability. The company's security bulletin index also showed no updates addressing this specific issue beyond their August 11th release, leaving many users exposed.
The successful exploitation of StyleSmuggler grants attackers full code execution capabilities on the targeted store's server, enabling them to install persistent backdoors. Sansec has indicated that all current versions of Magento and Adobe Commerce are potentially affected, including the latest 2.4.9 release. They successfully reproduced the unauthenticated exploit chain on clean installations of versions 2.4.7, 2.4.8, and 2.4.9, and noted that even a victim with Adobe's latest July and August security updates applied for the 2.4.6 release line was compromised.
While Sansec has not yet confirmed the vulnerability's impact on Adobe Commerce or Adobe Commerce on Cloud, and Adobe has not specified affected versions, the threat is considered widespread. Independent analysis from Disrex Group, a Magento hosting and development company, corroborates the exploitation. Disrex responded to two compromised stores on September 5th and observed attack traffic, providing further evidence that the vulnerability is being actively weaponized.
Sansec's interim recommendation for stores not running their Shield product is to disable GraphQL functionality until Adobe provides a fix. This is particularly relevant for headless and progressive web app storefronts, which rely heavily on GraphQL, while more traditional storefronts may be unaffected. Adobe's next scheduled security release is on September 8th, but it remains uncertain if this vulnerability will be addressed.
Details emerging from the incident response reveal sophisticated techniques used by the attackers. The implant is disguised as a Linux kernel thread process and installed in a non-standard location within the user's home directory, with a cron entry ensuring its persistence by restarting it every five minutes. The implant is described as a compact, statically linked Rust program, making it difficult to detect.
The attack chain involves two primary stages. First, attackers inject malicious PHP code into files that Magento legitimately writes, such as failure reports. Subsequently, they trigger Magento's "Payment Transaction Failed Reminder" email functionality. This causes the injected code to execute when Magento renders the email message, regardless of whether the email is actually delivered or opened, thereby achieving code execution.
Sansec plans to release a more detailed breakdown of the exploit chain, dropper, and implant in a future update. Disrex's analysis suggests the exploit leverages Magento's dependency-injection compiler to include attacker-chosen file paths, ultimately leading to the execution of a PHP dropper that downloads and launches the final implant. Both Sansec and Disrex highlight the need to search for specific markers in various log and report directories, as the exact location and format of these markers have been observed to drift, indicating an evolving attack.