Unpatched Magento flaw reportedly used to install Linux backdoor

Security researchers have reported active exploitation of an unpatched vulnerability in Magento and Adobe Commerce that can be used to gain code execution on affected e-commerce servers and install a Linux backdoor.

The issue, dubbed StyleSmuggler by e-commerce security firm Sansec, was reportedly observed in attacks beginning September 4, including against a system that had current security updates installed. Sansec said Adobe Enterprise Support confirmed it was developing a fix, although no release schedule was provided at the time of the report.

Backdoor deployment and persistence

According to Sansec, the exploit abuses Magento's template functionality through PHP injection. The attack generates a fraudulent failed-payment notification email and uses the resulting execution path to deploy malware on the server.

The payload is a compact backdoor written in Rust. Earlier samples reportedly ran under a process name resembling [kworker/u:8:0], while newer variants impersonate fc-cache and store themselves in a font-cache-related directory under the affected user's home folder. The attackers also create a cron task that runs every 30 minutes, providing a mechanism to restore or relaunch the malware.

Sansec said the implant can contact remote command-and-control infrastructure and accept instructions. Earlier versions used TLS and WebSockets, but more recent samples are said to disguise communications as Network Time Protocol traffic, sending UDP data to port 123 and using domains that resemble time synchronization services. This approach may make malicious traffic less conspicuous in environments that permit NTP traffic.

Detection and mitigation

The backdoor checks external services to identify the compromised server's public IP address and examines Linux tracing status. If it detects tracing, it may install but refrain from communicating with its operators.

• Investigate unexpected volumes of Magento “Payment Transaction Failed Reminder” emails.
• Review running processes for suspicious names resembling kworker or fc-cache.
• Check cron configurations and temporary directories for unauthorized additions.
• Rotate Magento credentials if compromise is suspected.

Until an official update is available, Sansec recommended disabling GraphQL as a temporary mitigation. Administrators should also monitor Adobe advisories and apply any vendor-provided security patch promptly after release.