A Magento StyleSmuggler zero-day vulnerability is being exploited to install a Linux backdoor on e-commerce servers, security researchers have warned. The first known attack was detected on September 4 against a website running the latest available security updates.
The flaw affects all versions of Magento and Adobe Commerce, according to e-commerce security firm Sansec. Adobe Enterprise Support has confirmed that it is working on a fix, but has not said when one will be released.
Magento, an open-source platform owned by Adobe, is used by more than 160,000 websites, including about 14,000 of the world’s top one million sites.
How the Magento StyleSmuggler attack works
The attack abuses Magento’s template system to inject PHP code. The code creates a fraudulent “failed-payment” reminder email, which in turn causes malicious instructions to run on the server.
Once access is obtained, the attackers install a small backdoor written in Rust. Earlier versions ran in the background under the name kworker/u:8:0, while newer samples have been disguised as fc-cache and placed in the user’s ~/.cache/fontconfig/ directory.
A cron job is also added to relaunch the malware every 30 minutes, helping it survive interruptions and maintain access to the compromised system.
Sansec said it had not observed further activity after the backdoor was installed, but the malware is capable of connecting to remote infrastructure and accepting commands.
Older versions communicated with their command-and-control server using encrypted TLS and WebSockets. More recent samples use UDP traffic on port 123, normally associated with the Network Time Protocol, and contact hostnames made to resemble legitimate time-synchronisation services.
The technique may help the malicious traffic pass through firewalls. The backdoor also checks a server’s public IP address using several external services and examines Linux’s TracerPid value. If it detects that the process is being traced, it installs itself but does not contact the attacker’s infrastructure.
Sansec said an unexpected increase in “Payment Transaction Failed Reminder” emails could be a sign of compromise. Administrators have also been advised to look for unfamiliar kworker or fc-cache processes, unusual cron entries and suspicious temporary files.
Businesses that believe a Magento installation has been breached should rotate their Magento credentials. Until Adobe issues a security update, Sansec recommends disabling GraphQL as a temporary mitigation.
Adobe’s next scheduled security release is due on September 8, although the company has not confirmed whether it will include a fix for StyleSmuggler.
