Add PolyShell vulnerability (CVE-2026-48356) page

docs/best-practices/security/how-to-deal-with-the-polyshell-vulnerability-cve-2026-48356-on-hypernode.md

@@ -0,0 +1,138 @@
+---
+myst:
+  html_meta:
+    description: PolyShell (CVE-2026-48356) is an unauthenticated file upload vulnerability
+      in Magento and Adobe Commerce. Learn how Hypernode protects your shop, how to
+      fix it, and how to check your shop for compromise.
+    title: How to Deal with the PolyShell Vulnerability (CVE-2026-48356) on Hypernode
+      | Security | Hypernode
+---
+
+# How to Deal with the PolyShell Vulnerability (CVE-2026-48356) on Hypernode
+
+PolyShell is an unauthenticated file upload vulnerability in Magento Open Source and Adobe Commerce, tracked as CVE-2026-48356. This article explains how the vulnerability works, what Hypernode does to protect your shop, how to fix it, and how to check whether your shop was compromised.
+
+For a full analysis of the vulnerability, the payloads and the attacks, see [PolyShell: unrestricted file upload in Magento and Adobe Commerce](https://sansec.io/research/magento-polyshell) by Sansec.
+
+## What Is PolyShell?
+
+Sansec discovered the PolyShell vulnerability and published it on 17 March 2026. The flaw has been exploited since March 2026, and CISA added it to its Known Exploited Vulnerabilities list on 27 October 2026. Sansec observed attacks on 79.5% of all stores, and by 14 April 2026, 82% of all stores had been hit with malicious uploads.
+
+The vulnerable code has existed since the very first Magento 2 release. All Magento Open Source and Adobe Commerce versions before the fix are affected.
+
+### How the Attack Works
+
+Magento's REST API accepts base64 file data in cart item custom options and writes it to `pub/media/custom_options/quote/`. The following guest cart routes need no credentials:
+
+- `POST /V1/guest-carts/:cartId/items`
+- `PUT /V1/guest-carts/:cartId/items/:itemId`
+
+According to Sansec, three checks are missing in this code:
+
+- The submitted option ID is never checked against the actual options of the product.
+- The file upload runs even if the product does not have a file-type option.
+- File extensions such as `.php`, `.phtml` and `.phar` are not blocked. The only validation is an image header check.
+
+Attackers use these routes to upload a polyglot file: a valid GIF or PNG image that also contains PHP code. Because the file starts with a valid image header, it passes Magento's image header check. GraphQL mutations use a different code path and are not vulnerable.
+
+After the upload, attackers deploy a second backdoor called `accesson.php` in several directories. They also inject an obfuscated JavaScript loader into CMS pages or static blocks. This loader stores its payload in the browser's `localStorage`, so the malware keeps running in the browsers of visitors even if the external source of the payload goes down.
+
+## What Hypernode Does
+
+Every Hypernode has the NGINX configuration files `server.block_polyshell_upload.conf` and `server.block_media_php.conf`, which are provisioned by the platform. These files block the execution of files in the upload directory.
+
+```{important}
+These configuration files do not block the upload itself, so uploaded files can still land on disk. Whether an uploaded file can run depends on the web server configuration. Installing the Adobe patch is the only way to fix the vulnerability.
+```
+
+Sansec also warns that an uploaded file stays on disk even when execution is blocked. A future configuration change, server migration, or web server swap could expose it. Remove any uploaded files you find, even if they cannot run on your Hypernode today. According to Sansec, only a web application firewall (WAF) that blocks the API call itself stops the upload, such as Sansec Shield.
+
+## How to Fix the Vulnerability
+
+Install Adobe's July 2026 patch. Adobe published security bulletin APSB26-73 on 14 July 2026, with `-2026-jul` releases and isolated patches (KA-37421) for the supported release lines.
+
+Sansec says that Magento 2.4.9, released on 12 May 2026, contains the fix. However, Adobe's CVE record lists 2.4.9 as affected until `2.4.9-2026-jul`. Follow Adobe's bulletin for your exact Magento version.
+
+For more information about installing patches, see [How to Apply Magento Patches](how-to-apply-magento-patches.md).
+
+```{note}
+Installing patches is the responsibility of the customer or their developer. If you need help, you can find a developer in our [partner directory](https://www.hypernode.com/en/partners/).
+```
+
+## How to Check Your Shop
+
+Even if you install the patch, your shop may already have been compromised. Run the commands below from your Magento root, for example `/data/web/magento2`.
+
+### Check the Upload Directory
+
+List all files in the upload directory:
+
+```bash
+find pub/media/custom_options/ -type f ! -name '.htaccess'
+```
+
+Look for PHP files in the upload directory. According to Sansec, any `.php`, `.phtml` or `.phar` file in `pub/media/custom_options/` is a strong sign of compromise:
+
+```bash
+find pub/media/custom_options -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \)
+```
+
+Because attackers hide PHP code in image files, also search the upload directory by content:
+
+```bash
+grep -rl "<?php" pub/media/custom_options
+```
+
+Sansec observed the following filenames in PolyShell attacks. The most common pattern adds the option ID in front of `index.php`, for example `780index.php`:
+
+`index.php`, `json-shell.php`, `bypass.phtml`, `c.php`, `r.php`, `rce.php`, `static.php`, `test.php`, `blocked-json.php`, `bypass-async.php`, `urlencode-shell.php`, `xx_malicious_file.php`, `ato_poc.html`, `mikhail.html`, `accesson.php`, `toggige-arrow.jpg`, `adman.429.txt`, `adman.309.txt`
+
+### Check for the accesson.php Backdoor
+
+Attackers place copies of the `accesson.php` backdoor outside the upload directory, so that at least one copy survives a cleanup or redeployment. They create an `assets/images/` subdirectory in every top-level folder they can write to, for example:
+
+- `app/assets/images/accesson.php`
+- `bin/assets/images/accesson.php`
+- `generated/assets/images/accesson.php`
+- `lib/assets/images/accesson.php`
+- `pub/assets/images/accesson.php`
+- `setup/assets/images/accesson.php`
+- `var/assets/images/accesson.php`
+- `vendor/assets/images/accesson.php`
+
+Search for the backdoor in your entire Magento installation:
+
+```bash
+find . -name "accesson.php" -type f
+```
+
+### Check Your CMS Content
+
+Check your CMS pages and static blocks for injected script loaders. According to Sansec, look in particular for references to the following domains:
+
+- `lanhd6549tdhse.top`
+- `jslibrary.net`
+- `canevaslab.com`
+
+```{note}
+Blocking these domains stops new payloads, but does not remove payloads that are already stored in the browsers of your visitors. Always remove the loader from your CMS content.
+```
+
+### Scan Your Shop with Sansec
+
+Manual checks do not always find all malware, because attackers often hide their code. A scan with [Sansec eComscan](https://sansec.io/ecomscan) helps you find malware, backdoors, and known vulnerabilities in your shop. eComscan comes preinstalled on every Hypernode. To start a scan, run the following command:
+
+```bash
+ecomscan /data/web/magento2
+```
+
+If your shop lives in a different folder, change the path accordingly. See [How to Set Up Sansec eComscan on Hypernode](../../hypernode-platform/tools/how-to-set-up-sansec-ecomscan-on-hypernode.md) for more information.
+
+### If You Find Signs of Compromise
+
+If you find signs of compromise, reset the following:
+
+- Admin passwords
+- API keys
+- Payment gateway tokens
+- The secrets in `app/etc/env.php`