Persistent Magento backdoor hidden in XML
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-20720 | Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS… | 9.1 | 4% | ||
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 216.73.163.170 | er IPs: 45.146.54.58 45.146.54.59 45.146.54.61 45.146.54.67 216.73.163.170 216.73.163.182 Read more StyleSmuggler: Magento and Adobe C |
| ipv4 | 216.73.163.182 | 54.58 45.146.54.59 45.146.54.61 45.146.54.67 216.73.163.170 216.73.163.182 Read more StyleSmuggler: Magento and Adobe Commerce 0-day R |
| ipv4 | 45.146.54.58 | rview . Attribution We observed the following attacker IPs: 45.146.54.58 45.146.54.59 45.146.54.61 45.146.54.67 216.73.163.170 216.7 |
| ipv4 | 45.146.54.59 | bution We observed the following attacker IPs: 45.146.54.58 45.146.54.59 45.146.54.61 45.146.54.67 216.73.163.170 216.73.163.182 Rea |
| ipv4 | 45.146.54.61 | erved the following attacker IPs: 45.146.54.58 45.146.54.59 45.146.54.61 45.146.54.67 216.73.163.170 216.73.163.182 Read more StyleS |
| ipv4 | 45.146.54.67 | lowing attacker IPs: 45.146.54.58 45.146.54.59 45.146.54.61 45.146.54.67 216.73.163.170 216.73.163.182 Read more StyleSmuggler: Mage |
From the original article
2 min read at sansec.io
The following XML code was found in the layout_update database table and is responsible for periodic reinfections of your system. Attackers combine the Magento layout parser with the beberlei/assert package (installed by default) to execute system commands. Because the layout block is tied to the checkout cart, this command is executed whenever <store>/checkout/cart is requested.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.