Adobe has launched an emergency hotfix, VULN-393411, for the vulnerability. However as a result of attackers had three days to take advantage of the flaw earlier than a repair arrived, Sansec warns that patching alone isn’t sufficient for shops that will have already got been compromised.
Assault triggered by way of failed cost e mail
StyleSmuggler’s first trick is to get malicious PHP code into knowledge that Magento itself will write out, comparable to a cost failure report. “StyleSmuggler intentionally triggers Magento’s normal ‘Cost Transaction Failed Reminder’e mail,” the researchers defined. “Surprising bursts of those messages are a cause to research, though official declined funds can generate the identical notification.”
The attackers abuse Magento’s template processing by passing specifically crafted “kinds properties,” permitting the poisoned knowledge, the injected PHP code, to execute on the server.
