diff --git a/docs/best-practices/security/how-to-deal-with-the-polyshell-vulnerability-cve-2026-48356-on-hypernode.md b/docs/best-practices/security/how-to-deal-with-the-polyshell-vulnerability-cve-2026-48356-on-hypernode.md new file mode 100644 index 00000000..482cbcc4 --- /dev/null +++ b/docs/best-practices/security/how-to-deal-with-the-polyshell-vulnerability-cve-2026-48356-on-hypernode.md @@ -0,0 +1,138 @@ +--- +myst: + html_meta: + description: PolyShell (CVE-2026-48356) is an unauthenticated file upload vulnerability + in Magento and Adobe Commerce. Learn how Hypernode protects your shop, how to + fix it, and how to check your shop for compromise. + title: How to Deal with the PolyShell Vulnerability (CVE-2026-48356) on Hypernode + | Security | Hypernode +--- + +# How to Deal with the PolyShell Vulnerability (CVE-2026-48356) on Hypernode + +PolyShell is an unauthenticated file upload vulnerability in Magento Open Source and Adobe Commerce, tracked as CVE-2026-48356. This article explains how the vulnerability works, what Hypernode does to protect your shop, how to fix it, and how to check whether your shop was compromised. + +For a full analysis of the vulnerability, the payloads and the attacks, see [PolyShell: unrestricted file upload in Magento and Adobe Commerce](https://sansec.io/research/magento-polyshell) by Sansec. + +## What Is PolyShell? + +Sansec discovered the PolyShell vulnerability and published it on 17 March 2026. The flaw has been exploited since March 2026, and CISA added it to its Known Exploited Vulnerabilities list on 27 October 2026. Sansec observed attacks on 79.5% of all stores, and by 14 April 2026, 82% of all stores had been hit with malicious uploads. + +The vulnerable code has existed since the very first Magento 2 release. All Magento Open Source and Adobe Commerce versions before the fix are affected. + +### How the Attack Works + +Magento's REST API accepts base64 file data in cart item custom options and writes it to `pub/media/custom_options/quote/`. The following guest cart routes need no credentials: + +- `POST /V1/guest-carts/:cartId/items` +- `PUT /V1/guest-carts/:cartId/items/:itemId` + +According to Sansec, three checks are missing in this code: + +- The submitted option ID is never checked against the actual options of the product. +- The file upload runs even if the product does not have a file-type option. +- File extensions such as `.php`, `.phtml` and `.phar` are not blocked. The only validation is an image header check. + +Attackers use these routes to upload a polyglot file: a valid GIF or PNG image that also contains PHP code. Because the file starts with a valid image header, it passes Magento's image header check. GraphQL mutations use a different code path and are not vulnerable. + +After the upload, attackers deploy a second backdoor called `accesson.php` in several directories. They also inject an obfuscated JavaScript loader into CMS pages or static blocks. This loader stores its payload in the browser's `localStorage`, so the malware keeps running in the browsers of visitors even if the external source of the payload goes down. + +## What Hypernode Does + +Every Hypernode has the NGINX configuration files `server.block_polyshell_upload.conf` and `server.block_media_php.conf`, which are provisioned by the platform. These files block the execution of files in the upload directory. + +```{important} +These configuration files do not block the upload itself, so uploaded files can still land on disk. Whether an uploaded file can run depends on the web server configuration. Installing the Adobe patch is the only way to fix the vulnerability. +``` + +Sansec also warns that an uploaded file stays on disk even when execution is blocked. A future configuration change, server migration, or web server swap could expose it. Remove any uploaded files you find, even if they cannot run on your Hypernode today. According to Sansec, only a web application firewall (WAF) that blocks the API call itself stops the upload, such as Sansec Shield. + +## How to Fix the Vulnerability + +Install Adobe's July 2026 patch. Adobe published security bulletin APSB26-73 on 14 July 2026, with `-2026-jul` releases and isolated patches (KA-37421) for the supported release lines. + +Sansec says that Magento 2.4.9, released on 12 May 2026, contains the fix. However, Adobe's CVE record lists 2.4.9 as affected until `2.4.9-2026-jul`. Follow Adobe's bulletin for your exact Magento version. + +For more information about installing patches, see [How to Apply Magento Patches](how-to-apply-magento-patches.md). + +```{note} +Installing patches is the responsibility of the customer or their developer. If you need help, you can find a developer in our [partner directory](https://www.hypernode.com/en/partners/). +``` + +## How to Check Your Shop + +Even if you install the patch, your shop may already have been compromised. Run the commands below from your Magento root, for example `/data/web/magento2`. + +### Check the Upload Directory + +List all files in the upload directory: + +```bash +find pub/media/custom_options/ -type f ! -name '.htaccess' +``` + +Look for PHP files in the upload directory. According to Sansec, any `.php`, `.phtml` or `.phar` file in `pub/media/custom_options/` is a strong sign of compromise: + +```bash +find pub/media/custom_options -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) +``` + +Because attackers hide PHP code in image files, also search the upload directory by content: + +```bash +grep -rl "