Magento StyleSmuggler Zero-Day Exploited to Install Linux Backdoor
Summary
Sansec reports active exploitation of the StyleSmuggler zero-day in all Magento and Adobe Commerce versions, deploying a Linux backdoor. Adobe was preparing a fix; Sansec advised disabling GraphQL until one is available.
Key points
- Sansec says the zero-day affects all Magento and Adobe Commerce versions; the first observed exploitation was September 4 on a fully updated target.
- Attackers abuse Magento’s template system with PHP code injection to trigger execution through a fake failed-payment email.
- Successful exploitation installs a Rust-based Linux backdoor, with cron-based persistence and process names disguised as kworker or fc-cache.
- The backdoor can receive remote commands; newer samples disguise command-and-control traffic as NTP over UDP port 123.
- Sansec recommends disabling GraphQL until a fix is available and monitoring for unusual reminder emails, processes, cron entries, and temporary files.
- Adobe had not released a fix at the time of publication; Sansec recommends rotating Magento credentials if compromise is suspected.
Article Details
- Vulnerability Types
- PHP code injection through Magento's template system
- Affected Versions
- Magento (all versions)
- Adobe Commerce (all versions)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Disable GraphQL until fixes are available.
MITRE ATT&CK
T1036 · MasqueradingThe backdoor disguises its process as [kworker/u:8:0] or fc-cache.T1053.003 · CronThe attacker adds a cron job configured to repeat every 30 minutes for persistence.T1071.001 · Web ProtocolsEarlier backdoor samples used TLS/WebSockets to communicate with the command-and-control address.T1095 · Non-Application Layer ProtocolNewer backdoor versions send NTP-like command-and-control traffic in UDP packets to port 123.T1622 · Debugger EvasionThe malware checks Linux's TracerPid value to detect tracing and does not beacon when tracing is active.
Vendors
Products
Adobe CommerceStyleSmuggler is a zero-day affecting all versions of Magento and Adobe Commerce that is being actively exploited to deliver a Rust-based backdoor.MagentoStyleSmuggler is a zero-day affecting all versions of Magento and Adobe Commerce that is being actively exploited to deliver a Rust-based backdoor.