Thought Leadership
A zero-day vulnerability dubbed StyleSmuggler in all versions of Magento as well as Adobe Commerce is already being actively exploited for attacks.
According to e-commerce security firm Sansec, the first documented exploitation attempt was detected on September 4 on a target that already had the latest available security updates installed.
Magento is a popular open-source e-commerce platform by Adobe installed on more than 160,000 websites, including 14,000 of the world’s top one million most visited sites. The exploit observed in the wild by Sansec abuses Magento’s template system via an injected line of PHP code to generate a fake email with the subject line “failed payment,” thereby triggering the actual code execution.
Upon successful exploitation, the attack installs a small backdoor written in the Rust programming language as a background process, disguised as [kworker/u:8:0]. Newer versions disguise the process as fc-cache instead and additionally copy themselves to the ~/.cache/fontconfig/fc-cache directory. For persistent access, the attacker additionally sets up a scheduled task recurring every 30 minutes. Although Sansec did not observe any actual follow-up activity, the malware can fundamentally communicate with remote infrastructure and receive commands.
Disguise as time synchronization traffic
According to Sansec researchers, older samples of the backdoor communicated with the control server via TLS and WebSockets, whereas newer versions disguise their own traffic as Network Time Protocol by sending UDP packets to port 123 using hostnames that resemble typical time synchronization infrastructure, making it easier to sneak malicious traffic through firewalls. Additionally, the malware determines the public IP address of the affected server via services like ipify, icanhazip, ident.me, and ipinfo.io, and checks the Linux value TracerPid to detect a potential analysis environment. If such monitoring is detected, the malware still installs itself, but does not check in with the control server.
According to Sansec, an unusual spike in Magento emails with subject lines regarding failed payment reminders can indicate a successful exploitation. The company also recommends specifically searching for processes named kworker or fc-cache, suspicious entries in the scheduled task system, as well as temporary files. If a compromise is suspected, all Magento credentials should be changed.
Adobe working on patch, no release date given
According to Sansec, Adobe Enterprise Support has already confirmed it is working on a fix, but did not specify a concrete timeframe for release. At the time of reporting, Adobe had not yet released a patch for StyleSmuggler, with the company’s next scheduled security release set for the following day. Until an official fix is available, Sansec recommends disabling the GraphQL interface on affected systems as a temporary countermeasure.
(Editorial Team)
