Ethical Hacking News
A new zero-day vulnerability in Magento and Adobe Commerce has left many online stores vulnerable to attacks. The StyleSmuggler vulnerability allows unauthenticated attackers to execute code and install backdoors on stores that may already be patched. Operators and security teams should be on the lookout for suspicious activity and take immediate action to protect their stores from this critical vulnerability.
Magento Open Source releases 2.4.7, 2.4.8, and 2.4.9 are affected by the StyleSmuggler zero-day vulnerability. The vulnerability allows unauthenticated attackers to execute code and install backdoors on stores. The attack exploits Magento's template system to inject malicious code, which can be executed even if a store has been updated. The vulnerability does not require a victim to open an attachment, click a link, or receive a successful email. A second attacker is operating against stores compromised through StyleSmuggler, using a compact PHP dropper and web shell. Operators should be on the lookout for suspicious processes, NTP-like domains, and UDP port 123 destinations. Security teams should treat compromised systems as compromised, isolate the host, and rotate credentials.
The world of e-commerce has been rocked by a new zero-day vulnerability, dubbed StyleSmuggler, which has left many online stores vulnerable to attacks. The vulnerability, which affects current Magento Open Source releases, including 2.4.7, 2.4.8, and 2.4.9, was discovered by Sansec researchers, who reported that exploitation began on September 4. The attack allows unauthenticated attackers to execute code and install backdoors on stores that may already be patched.
According to Sansec, the attack works by injecting malicious code into Magento's template system, which can then be executed by the platform when it renders its standard "Payment Transaction Failed Reminder" notification. This means that even if a store has been updated according to its normal process, it can still be exposed to the attack. The vulnerability is especially dangerous because it does not require a victim to open an attachment, click a link, or even receive a successful email.
The attack uses GraphQL-related handling and the "styles" property to evade safeguards that would normally reject dangerous input. Sansec also found signs of a second, apparently unrelated attacker operating against stores compromised through StyleSmuggler. This actor deployed a compact PHP dropper that placed a web shell inside the product-image cache, using hash-like directory names to make the extra PHP file less obvious.
The web shell returns a normal-looking 404 response unless a request contains the correct "X-Cache-Token" header. With the header present, it can execute PHP supplied through a POST parameter. The attackers use domains that resemble time servers to disguise their command and control. The implant sends 48-byte UDP packets to port 123, which looks like NTP server replies, but the remaining data can carry the agent ID, hostname, username, operating-system version, memory and disk use, uptime, root status, and implant version.
Sansec observed a lightweight Rust backdoor that connects to attacker-controlled infrastructure and waits for commands. The malware initially hid behind a process name resembling [kworker/u:8:0], then appeared as fc-cache on September 6 and as chronyd on September 7. The attackers use cron to restart twice an hour, and the command channel is disguised as time synchronisation traffic.
Operators should be on the lookout for processes named [kworker/u:8:0], fc-cache, and chronyd that run from unusual paths such as temporary directories, user cache directories, or hidden folders. They should also inspect outbound traffic to suspicious NTP-like domains and UDP port 123 destinations, particularly 185.157.160.251, which Sansec linked to the observed domains on September 7. Security teams should search authentication and system logs for repeated "crontab command not allowed" messages generated by the web-service user, such as www-data.
If compromise indicators appear, security teams should treat the system as compromised, not merely vulnerable. They should isolate the host, preserve logs and forensic evidence, rotate Magento administrator credentials, API tokens, database credentials, payment-provider secrets, and cloud keys, then search for secondary backdoors before restoring normal operations.
The Sansec StyleSmuggler report includes current indicators of compromise, malware hashes, C2 infrastructure, suspicious process names and file paths. Its guidance will likely change as the campaign develops, because the attackers have already changed payload names and persistence methods within days.
Related Information:
https://www.ethicalhackingnews.com/articles/The-StyleSmuggler-Zero-Day-Attack-A-Critical-Vulnerability-in-Magento-and-Adobe-Commerce-ehn.shtml
https://securityaffairs.com/198603/uncategorized/stylesmuggler-the-magento-zero-day-behind-new-store-attacks.html
Published: Mon Sep 7 16:45:23 2026 by llama3.2 3B Q4_K_M
