Adobe Commerce / Magento Open Source BlockStrap Template Engine Injection Unauthenticated RCE

#!/usr/bin/env bash
# check_blockstrap.sh — Verify BlockStrap (CVE-2026-103849) and StyleSmuggler (CVE-2026-75650) patch status
# Usage: bash check_blockstrap.sh [/path/to/magento/root]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -uo pipefail

MAGE_ROOT="${1:-.}"
TEMPLATE_PHP="${MAGE_ROOT}/vendor/magento/framework/Filter/Template.php"
PATCH_CMD="${MAGE_ROOT}/vendor/bin/magento-patches"
RESULT="PATCHED"

echo "=== CVE-2026-103849 (BlockStrap) + CVE-2026-75650 (StyleSmuggler) Patch Checker ==="
echo "Magento root: $(cd "${MAGE_ROOT}" 2>/dev/null && pwd || echo "${MAGE_ROOT}")"
echo "Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo ""

# Pre-check: confirm Magento installation
if [ ! -f "${MAGE_ROOT}/app/etc/env.php" ]; then
    echo "[UNKNOWN] Cannot find app/etc/env.php — is this a Magento root directory?"
    exit 2
fi

# Check 1: BlockStrap patch (CVE-2026-103849)
# The October 2026 patch adds resolveDeferredDirectives() to Template.php
if [ -f "${TEMPLATE_PHP}" ]; then
    BS_COUNT=$(grep -c 'resolveDeferredDirectives' "${TEMPLATE_PHP}" 2>/dev/null || echo "0")
    if [ "${BS_COUNT}" -gt 0 ]; then
        echo "[PASS] BlockStrap (CVE-2026-103849): PATCHED"
        echo "       resolveDeferredDirectives found in Template.php (${BS_COUNT} occurrence(s))"
    else
        echo "[FAIL] BlockStrap (CVE-2026-103849): VULNERABLE"
        echo "       resolveDeferredDirectives NOT found in Template.php"
        RESULT="VULNERABLE"
    fi
else
    echo "[UNKNOWN] Template.php not found at: ${TEMPLATE_PHP}"
    exit 2
fi

# Check 2: StyleSmuggler hotfix (CVE-2026-75650 / VULN-39341)
# Both patches are required — they are NOT cumulative
if [ -x "${PATCH_CMD}" ]; then
    SS_STATUS=$("${PATCH_CMD}" -n status 2>/dev/null | grep -i '39341' || true)
    if [ -n "${SS_STATUS}" ]; then
        echo "[PASS] StyleSmuggler (CVE-2026-75650 / VULN-39341): hotfix detected"
    else
        echo "[FAIL] StyleSmuggler (CVE-2026-75650 / VULN-39341): hotfix NOT detected"
        RESULT="VULNERABLE"
    fi
else
    echo "[INFO] magento-patches CLI not available — checking Template.php for signing logic"
    SS_SIGN=$(grep -c 'validateDirectiveSignature\|signDirective' "${TEMPLATE_PHP}" 2>/dev/null || echo "0")
    if [ "${SS_SIGN}" -gt 0 ]; then
        echo "[PASS] StyleSmuggler signing logic detected in Template.php (${SS_SIGN} occurrence(s))"
    else
        echo "[WARN] StyleSmuggler signing logic NOT found — verify VULN-39341 hotfix manually"
        RESULT="VULNERABLE"
    fi
fi

# Check 3: Version identification
echo ""
if [ -f "${MAGE_ROOT}/composer.lock" ]; then
    FW_VER=$(grep -A4 '"magento/framework"' "${MAGE_ROOT}/composer.lock" 2>/dev/null | grep '"version"' | head -1 | sed 's/.*"version".*"\(.*\)".*/\1/')
    PROD_VER=$(grep -A4 '"magento/product-community-edition\|magento/product-enterprise-edition"' "${MAGE_ROOT}/composer.lock" 2>/dev/null | grep '"version"' | head -1 | sed 's/.*"version".*"\(.*\)".*/\1/')
    echo "[INFO] magento/framework version: ${FW_VER:-unknown}"
    echo "[INFO] Product edition version:   ${PROD_VER:-unknown}"
    echo "[INFO] Look for dated suffix '2026-oct' or patch level p5/p10/p15/p17/p18 to confirm fix"
fi

# Check 4: Quick post-exploitation artifact scan
echo ""
echo "=== Quick Post-Exploitation Artifact Scan ==="
# Spurious lock file from patch process
if [ -f "${MAGE_ROOT}/976bc24c" ]; then
    echo "[INFO] File '976bc24c' found in root (benign — created by patch process, safe to delete)"
fi
# Unknown compiled binaries (Rust backdoor indicator from StyleSmuggler campaigns)
SUSPECT_BINS=$(find "${MAGE_ROOT}/pub" "${MAGE_ROOT}/var" -type f -executable -newer "${MAGE_ROOT}/app/etc/env.php" 2>/dev/null | head -5 || true)
if [ -n "${SUSPECT_BINS}" ]; then
    echo "[ALERT] Executable files found in pub/ or var/ (possible backdoor):"
    echo "${SUSPECT_BINS}"
fi
# Basic skimmer keyword scan in static assets
SKIM_HITS=$(grep -rl 'exfil\|skimmer\|cc_number\|cvv_field' "${MAGE_ROOT}/pub/static/" 2>/dev/null | head -3 || true)
if [ -n "${SKIM_HITS}" ]; then
    echo "[ALERT] Possible skimmer keywords found in pub/static/:"
    echo "${SKIM_HITS}"
fi
[ -z "${SUSPECT_BINS}${SKIM_HITS}" ] && echo "[OK] No obvious post-exploitation artifacts found."

# Final verdict
echo ""
echo "=============================="
echo "${RESULT}"
echo "=============================="
if [ "${RESULT}" = "VULNERABLE" ]; then
    echo "ACTION: Apply APSB26-153 patches immediately. Both BlockStrap and StyleSmuggler fixes required."
    exit 1
else
    echo "Both BlockStrap and StyleSmuggler patches detected."
    exit 0
fi