Security researchers at Sansec have discovered an actively exploited RCE zero-day in Magento and Adobe.

Through this blog, we will understand what the StyleSmuggler zero-day is about, the threat it poses, and what organizations can do to defend.

About the vulnerabilities

How can attackers exploit it?

Stage 1 – Injection/Poisoning

a. Targets vulnerable installations

An unauthenticated attacker targets vulnerable Magento/Adobe Commerce installation

b. Sends crafted styles[…] request

The attacker sends a crafted request that abuse the styles functionality, bypassing Magento’s safeguards.

c. PHP code is injected/poisoned

The malicious PHP code is written to a Magento generated file (like a failure report (log file)).

d. The poisoned file is ready for attack

The poisoned file contains the malicious code but isn’t executed.

Stage 2 – Execution

Trigger: failed-payment email

The attacker triggers failed-payment email like “Reminder: Payment Transaction Failed”. The customer does not need to open or even receive the email.

Magento renders the template

Magento processes the email template, causing it to include and exclude the poisoned file.

Malicious PHP executes

The injected PHP code executes, resulting in remote code execution under Magento process privileges.

Remote Code Execution

The attacker gains remote code execution under the privileges of the Magento process.

Backdoor/Implant deployed

A small Rust-based implant is dropped and stored outside the webroot. A cron job relaunches it every five minutes. The implant establishes outbound connections to attacker-controlled infrastructure.

Indicators of Compromise

C2 / Infrastructure:

• 247[.]cdnflare[.]xyz
• 99[.]84[.]67[.]186:443
• windwsecurity[.]run:443
• ntp[.]timesysnc[.]net:123
• time[.]microsft[.]run:123
• pool[.]microsft[.]studio:123
• 88[.]216[.]72[.]181

Files / Persistence:

• ~/.local/share/.gvfsd/gvfsd-user
• ~/.local/share/.gvfsd/.gvfsd_<8hex>.lock
• /tmp/.kw_<random><random>
• Process disguised as [kworker/u:8:0]
• Registry-independent cron persistence:
•  /5 **** exec <home>/.local/share/.gvfsd/gvfsd-user

Reported SHA-256 hashes:

• e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7
• b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420

Attackers can exploit the zero-day flaw to:

• Execute malicious codes remotely
• Install backdoors
• Establish persistent access to an affected e-commerce environment
• Execute attacker-controlled commands
• Steal sensitive Magento/Adobe data
• Use the compromised systems to further orchestrate attacks

Official security guidance

There is no official security patch released as of yet. As a temporary measure, Sansec has recommended disabling GraphQL until an official fix is released.

SharkStriker’s recommendations

• Identify all Magento and Adobe Commerce deployments within the environment.
• Prioritize internet-facing e-commerce systems for immediate assessment.
• Monitor for the published StyleSmuggler indicators.
• Review Magento application, web-server, process, and cron activity for suspicious changes.
• Investigate unexpected failed-payment email activity.
• Monitor GraphQL requests for suspicious styles[…] parameters.
• Apply the official Adobe security update as soon as it becomes available.
• If compromise indicators are identified, isolate the affected system and conduct a full malware and persistence investigation.

SharkStriker’s Actions

• Threat intelligence validation completed using the Sansec research.
• StyleSmuggler attack characteristics and published IOCs reviewed.
• Detection opportunities identified for endpoint, application, web, and network monitoring.
• Threat hunting recommended for exposed Magento and Adobe Commerce environments.
• Detection engineering recommended to monitor the published C2 infrastructure, suspicious processes, cron persistence, and malicious GraphQL activity.