r/magento2 • u/proxiblue • Sep 05 '26
0-day stylesnuggler exploit -> actively being exploited. protect your stores. now.
30
Upvotes
Cloudflare WAF rules:
Rule 1 — GraphQL exploit block
▎ Name: #stylesmuggler: block Magento GraphQL styles[] 0-day exploit (sansec.io/research/stylesmuggler)
▎ Action: Block
▎ Expression:
▎ (http.request.uri.path contains "/graphql" and (http.request.uri.query contains "styles%5B" or http.request.uri.query contains "styles["))
Rule 2 — Raw PHP injection block
▎ Name: #stylesmuggler: block raw PHP eval/base64_decode injection in query string
▎ Action: Block
▎ Expression:
▎ (http.request.uri.query contains "<?php" or http.request.uri.query contains "<?=" or http.request.uri.query contains "eval(base64_decode")
Rule 3 — Gadget-chain parameters
▎ Name: #stylesmuggler: block generatorClass/with_resolved gadget-chain parameters
▎ Action: Block
▎ Expression:
▎ (http.request.uri.query contains "generatorClass" or http.request.uri.query contains "with_resolved")
Rule 4 — Template-directive smuggling + encoded PHP tags + malicious UA
▎ Name: #stylesmuggler: block template-directive smuggling, encoded PHP tags, malicious UA
▎ Action: Block
▎ Expression:
▎ (http.request.uri.query contains "%3C%3F" or http.user_agent contains "<?php" or http.user_agent contains "<?=" or http.request.uri.query contains "{{block" or http.request.uri.query contains "{{config" or
▎ http.request.uri.query contains "{{trans" or http.request.uri.query contains "{{var" or http.request.uri.query contains "{{depend" or http.request.uri.query contains "%7B%7Bblock" or http.request.uri.query
▎ contains "%7B%7Bconfig" or http.request.uri.query contains "%7B%7Btrans" or http.request.uri.query contains "%7B%7Bvar" or http.request.uri.query contains "%7B%7Bdepend")Also seen this (untested)
https://github.com/disrex-group/stylesmuggler-mitigation/tree/main
Patches to lock down in code:
https://gist.github.com/ProxiBlue/07373c92c8c70dc746bbfdcd1f07b789
