Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores 未修补的Magento和Adobe Commerce零日漏洞被利用来后门化在线商店

TL;DR

• A critical unpatched zero-day vulnerability (dubbed "StyleSmuggler") in Magento Open Source and Adobe Commerce allows unauthenticated attackers to execute arbitrary code and install persistent backdoors on online store servers
• All current Magento versions are affected, including 2.4.7 through 2.4.9, and even stores with the latest security patches applied have been compromised
• Adobe had not released a patch, CVE identifier, or advisory as of September 6, with the next scheduled security release on September 8
• The interim mitigation recommended is to temporarily disable GraphQL, though this may break headless and PWA storefronts that depend on it
• Independent incident response by Disrex Group confirmed active exploitation, with two compromised stores breached within an eight-hour window before any defensive rules existed

Why It Matters

This zero-day represents a critical threat to the e-commerce ecosystem, as Magento powers a significant portion of online retail infrastructure worldwide. The fact that patch status was irrelevant to the compromises underscores that unpatched vulnerabilities in widely deployed platforms can be weaponized immediately, leaving merchants with no defense beyond workarounds that may disrupt business operations.

Technical Details

• The vulnerability (CVE pending) allows unauthenticated remote code execution on Magento Open Source and Adobe Commerce servers, with Sansec reproducing the full attack chain on clean installations of versions 2.4.7, 2.4.8, and 2.4.9
• The implant is a sophisticated persistent backdoor: a stripped, statically linked Rust binary (~1.9 MB) disguised as a Linux kernel thread named [kworker/u:8:0], installed at ~/.local/share/.gvfsd/gvfsd-user under the site user's home directory, with a cron entry restarting it every five minutes written directly to /var/spool/cron/crontabs/ to evade system log detection
• On at least one compromised store, the implant made no outbound connections to command-and-control servers; instead, it maintained 28 connections to the store's own Redis instance on port 6379 to read Magento session storage, suggesting a stealthier data-access approach
• The vulnerability affects the GraphQL endpoint, meaning headless and progressive web app storefronts are disproportionately impacted since they require GraphQL, while classic and Hyvä storefronts may be less exposed
• Disrex Group's incident response confirmed that even a Sansec Shield-protected store running Magento 2.4.8 was breached before defensive rules were deployed, and an unpatched store running Magento 2.4.7-p2 (eight patch levels behind) was also compromised

Industry Insight

• E-commerce merchants using Magento should immediately assess their GraphQL exposure and consider temporary mitigation strategies, accepting the operational trade-off of potentially breaking headless storefronts until Adobe releases a patch
• The incident highlights the critical importance of runtime protection and WAF rules for zero-day vulnerabilities, as patch management alone cannot prevent exploitation of unpatched flaws in the immediate window after disclosure
• Organizations should treat this as a reminder to implement defense-in-depth strategies, including network segmentation, credential rotation protocols, and continuous monitoring for anomalous processes disguised as system threads, since attackers are already weaponizing this vulnerability in the wild

TL;DR

• Magento Open Source和Adobe Commerce曝出未修补零日漏洞"StyleSmuggler"，攻击者无需登录即可在服务器执行恶意代码并安装持久后门
• 所有当前版本（含2.4.9）均受影响，Adobe截至9月6日未发布补丁、CVE标识或临时解决方案
• 后门程序伪装成Linux内核线程[kworker/u:8:0]，使用静态链接Rust编写，通过cron每5分钟重启实现持久化
• 独立验证显示即使已应用最新安全补丁的商店也在漏洞披露后8小时内被攻破，补丁状态并非防护关键
• 临时缓解建议是禁用GraphQL功能，但无头 storefront和PWA应用将受影响

为什么值得看

该漏洞揭示了主流电商平台在零日攻击下的脆弱性，对依赖Magento的商家和开发者具有直接安全警示意义。Disrex团队在事件响应中利用AI辅助快速生成防御规则，展示了AI在实时安全威胁应对中的实用价值。漏洞利用链和隐蔽后门技术为安全研究人员提供了分析未修补漏洞攻击模式的典型案例。

技术解析

漏洞利用链：攻击者通过未认证的GraphQL请求触发代码执行，无需登录即可在服务器端植入持久后门。Sansec在Magento Open Source 2.4.7、2.4.8和2.4.9版本上成功复现了完整攻击链。

后门特征：恶意程序伪装成系统进程[kworker/u:8:0]，二进制文件位于~/.local/share/.gvfsd/gvfsd-user，使用静态链接的Rust编写（约1.9MB），通过直接写入/var/spool/cron/crontabs/实现持久化，系统日志无记录。

数据窃取行为：部分后门仅建立与本地Redis实例（端口6379）的连接，读取Magento会话存储，未显示外部命令与控制通信，增加了检测难度。

临时缓解措施：建议未使用Sansec Shield的商店临时禁用GraphQL功能，但需注意无头（headless）和渐进式Web应用（PWA） storefront依赖GraphQL，禁用可能导致服务中断。

补丁状态无关性：Disrex验证显示，即使运行最新安全补丁（如2.4.6-p15）的商店也在漏洞公开后8小时内被攻破，表明零日漏洞的利用不依赖补丁缺失。

行业启示

电商平台必须建立零日漏洞的快速响应机制，包括实时监控、临时缓解措施和定期安全审计，不能仅依赖厂商补丁周期。采用无头架构和PWA storefront的商店面临更高风险，需在GraphQL安全加固和替代方案之间权衡。安全事件响应中AI辅助工具可显著提升效率，但需验证生成内容的可靠性，避免未经测试的规则直接应用于生产环境。