A zero-day flaw known as “StyleSmuggler,” which impacts all versions of Magento and Adobe Commerce, is currently being exploited in attacks aimed at deploying a backdoor.
The initial incident of exploitation was documented on September 4, targeting a system that had the latest security updates installed.
According to e-commerce security firm Sansec, Adobe Enterprise Support confirmed earlier today that they are working on a solution, although no timeline for its release has been provided.
Magento, an open-source e-commerce platform developed by Adobe, is utilized on over 160,000 websites, including 14,000 of the top 1 million sites.
The exploit observed by Sansec takes advantage of Magento’s template system through PHP code injection, which generates a fraudulent “failed-payment” email that initiates code execution.
Successful exploitation results in the installation of a small Rust-based backdoor that operates as a background process, camouflaged as [kworker/u:8:0]. In newer versions, the process is disguised as fc-cache and is copied to ~/.cache/fontconfig/fc-cache.
Sansec researchers report that the attacker also sets up a cron job that is configured to run every 30 minutes to ensure persistence.
While Sansec did not observe any subsequent activity, the malware is capable of communicating with remote infrastructure and receiving commands.
The researchers indicate that earlier versions of the backdoor utilized TLS/WebSockets for communication with the command-and-control (C2) address, whereas newer iterations mask their traffic as Network Time Protocol (NTP).
These versions send UDP packets to port 123 and use hostnames that mimic time-syncing infrastructure, which helps to disguise malicious traffic as NTP and evade firewalls.
The malware also identifies the server’s public IP using services such as ipify, icanhazip, ident.me, and ipinfo.io, and checks the TracerPid value in Linux to detect if tracing is active. If tracing is detected, the malware still installs but refrains from beaconing.
Sansec suggests that an unexpected increase in Magento
Source: Original article
