Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.
Sansec disclosed on September 5 that attackers are exploiting an unpatched vulnerability, named StyleSmuggler, in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution, with attacks observed starting September 4. All current versions including 2.4.9 are affected, and Adobe has published no advisory, CVE, patch, or workaround, with the next scheduled security release on September 8. Hosting firm Disrex Group independently confirmed two compromised stores (running 2.4.8 and 2.4.7-p2), both breached within the roughly eight-hour window before Sansec's blocking rules went live. The implant is a ~1.9 MB statically linked Rust binary disguised as a Linux kworker process, re-adding a cron entry every five minutes and in one case reading Magento sessions directly from Redis with no outbound traffic.
- Attacks began September 4; Sansec reproduced the unauthenticated chain on clean Magento 2.4.7, 2.4.8, and 2.4.9 installs.
- Adobe has released no advisory, CVE, patch, or workaround; its next scheduled security release is September 8.
- Implant masquerades as a Linux kworker thread, installs under the site user's home directory, and re-adds a cron entry every five minutes.
- Disrex confirmed two breached stores, contained the same day with no evidence of data exfiltration or lateral movement.
- Interim mitigation: disable GraphQL where the storefront design permits, until Adobe ships an official fix.
- Vendors
- AdobeSansecDisrex Group
- Malware
- StyleSmuggler
- Organizations
- SansecDisrex GroupAdobe
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdnflare.xyz | 69bf220 (running in memory on one Disrex store) Domain: 247.cdnflare[.]xyz (malware download host) IP: 99.84.67[.]186:443 (command-a |
| ipv4 | 5.181.86.133 | nsec) IP: 88.216.72[.]181 (attacker source, per Sansec) IP: 5.181.86[.]133 (attacker source sending in bulk, per Disrex) Sansec reco |
| ipv4 | 88.216.72.181 | command-and-control over WebSocket and TLS, per Sansec) IP: 88.216.72[.]181 (attacker source, per Sansec) IP: 5.181.86[.]133 (attacke |
| ipv4 | 99.84.67.186 | ore) Domain: 247.cdnflare[.]xyz (malware download host) IP: 99.84.67[.]186:443 (command-and-control over WebSocket and TLS, per Sans |
| sha256 | 251fabd50d7b18a8b5e1b3ef5d64e7198c17244778f6461fb1ab07f6169bf220 | 705adec1902a1d06ef (on disk on both Disrex stores) SHA-256: 251fabd50d7b18a8b5e1b3ef5d64e7198c17244778f6461fb1ab07f6169bf220 (running in memory on one Disrex store) Domain: 247.cdnflar |
| sha256 | 8334b434fa3fe9f59cebe9609b11e0b1fd19d10212c45c705adec1902a1d06ef | b2b05d81391285eebc2af664641a26a7 (Sansec's sample) SHA-256: 8334b434fa3fe9f59cebe9609b11e0b1fd19d10212c45c705adec1902a1d06ef (on disk on both Disrex stores) SHA-256: 251fabd50d7b18a8b5 |
| sha256 | e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7 | /gvfsd-user , with a variant pointing at /tmp/.kw_ SHA-256: e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7 (Sansec's sample) SHA-256: 8334b434fa3fe9f59cebe9609b11e0b1 |
From the original article
12 min read at thehackernews.com
Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4. "Sansec is
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.