Attackers Exploit Unpatched Magento Zero-Day to Backdoor Online Stores
Attackers are exploiting an unpatched flaw in Adobe Commerce and Magento Open Source to secretly install backdoors on online stores. The attackers then use those backdoors to steal customer data or redirect payments.
- Report priority
- High
How it works
- Attackers send a special request to the store's GraphQL interface, which is a way for apps to ask the store for data.
- The store then writes malicious PHP code into its own files, like error logs.
- Later, when the store sends a 'payment failed' email reminder, the attacker's code runs in the background and lets them take over the store.
What to do
Check if you use Adobe Commerce or Magento Open Source. If you're unsure, look for the Magento logo or 'Magento' in your store's backend settings. If you're running an older version without the September 2023 patch, you're affected. Adobe has not yet released a fixed version as of September 7, 2023.
Monitor Adobe's official Magento security bulletin for updates. In the meantime, disable the GraphQL interface if possible or restrict access to it. If you suspect your store has been compromised, contact Adobe support or a Magento security expert immediately.
Technical details
Attackers send a crafted GraphQL request to a vulnerable Magento store, which writes malicious PHP code into the store's own error log files. When the store later sends a payment reminder email, the attacker's code executes and installs a backdoor, allowing them to steal customer data or redirect payments.
A previously undisclosed remote code execution vulnerability, dubbed StyleSmuggler, affects Adobe Commerce (Magento Open Source) versions 2.4.6-p15, 2.4.7, 2.4.8, and 2.4.9. Attackers exploit it via a two-stage chain: injecting PHP payloads into auto-generated Magento files (like error logs) and triggering execution through the "Payment Transaction Failed Reminder" email system, which runs without user interaction. The flaw was first observed on September 4, with no vendor patch available as of September 6.
Even fully patched stores (e.g., 2.4.6-p15) are confirmed vulnerable. The backdoor implant evades detection by running under a spoofed Linux process name ([kworker/u:8:0]) and respawns via cron every five minutes. Attackers use 247.cdnflare.xyz in their operations. Mitigations include disabling GraphQL, restricting PHP's proc_open, and mounting /tmp, /var/tmp, and /dev/shm as no-execute.
No CVE ID has been assigned.