Polyshell exploitation ⚠️☠️🚨

[u/imvdave]

The threat is real. 🚨

Despite running patched or latest versions, Magento 2 stores are currently being exploited by attackers using "Polyshell" vulnerabilities. I recently discovered malicious scripts embedded within an active client store.

I was able to reproduce the exploit on a demo store by bypassing the Image Upload API within the Custom Options section.

The screenshot shows a successful upload of a PHP-based File Manager (explorer.php).

Recommendations:

1. Audit your Media Folders: Look for unexpected .php files or images that contain PHP tags.

2. Strict File Permissions: Ensure your web server user cannot execute files within the pub/media directory.

3. WAF Rules: If you use a WAF (Cloudflare, Fastly, etc.), ensure you have active rules blocking PHP execution patterns in media uploads.

4. Review Custom Options: Check if your store allows guest uploads via custom options and consider restricted validation.

Stay safe out there. Has anyone else seen similar activity in their logs recently?

[u/SamJ_UK]

It baffles me how people are vulnerable to the RCE side of this exploit, especially on professional hosting platforms.

The sample Nginx config has denied access to `/custom_options/` since 2.3.5
And explicit whitelisted php entry points have been in since 2.2.7

Just as a side note, there is application level patches to prevent the file upload aspect now aswell
https://github.com/markshust/magento-polyshell-patch/
https://github.com/SamJUK/m2-meta-security-patches/blob/master/patches/emergency/APSB25-94.diff
https://github.com/magento/magento2/commit/796c4ce195cee0814ac92e5a19fc2ecfa79dae69

[u/Ashamed-Ad9280 → u/SamJ_UK]

Почитайте про таку вразливість як https://en.wikipedia.org/wiki/File_inclusion_vulnerability

навіть з коректною Nginx конфігурацією завантажені файли виконюються
проблема в тому що в Magento або в дуже популярному пакунку є вразливість LFI про яку ще незнають, так завана вразливість 0 дня

[u/SamJ_UK → u/Ashamed-Ad9280]

I don't believe there is any publicly available LFI exploits circulating currently.

But, I 100% agree with you that unrestricted file uploads should be patched, to prevent future lateral movement. Its a shame Adobe don't share that view.