Adobe Commerce guest-cart REST API unrestricted polyglot file upload (PolyShell)

#!/usr/bin/env bash
# CVE-2026-48356 (PolyShell) Vulnerability Check
# Checks Adobe Commerce / Magento Open Source for APSB26-73 patch status
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -uo pipefail

MAGENTO_ROOT="${1:-}"

if [[ -z "$MAGENTO_ROOT" ]]; then
  echo "[!] Usage: $0 /path/to/magento/root"
  echo "Result: UNKNOWN"
  exit 2
fi

if [[ ! -d "$MAGENTO_ROOT/vendor/magento" ]]; then
  echo "[!] $MAGENTO_ROOT does not appear to be a Magento installation"
  echo "Result: UNKNOWN"
  exit 2
fi

# Detect version
VERSION=""
if [[ -f "$MAGENTO_ROOT/composer.lock" ]]; then
  VERSION=$(python3 -c "
import json, sys
with open('$MAGENTO_ROOT/composer.lock') as f:
    data = json.load(f)
for p in data.get('packages', []):
    if p['name'] in ('magento/product-community-edition','magento/product-enterprise-edition'):
        print(p['version']); sys.exit(0)
" 2>/dev/null || true)
fi
if [[ -z "$VERSION" ]] && command -v php &>/dev/null && [[ -f "$MAGENTO_ROOT/bin/magento" ]]; then
  VERSION=$(php "$MAGENTO_ROOT/bin/magento" --version 2>/dev/null | grep -oP '[\d]+\.[\d]+\.[\d]+(-p\d+)?' || true)
fi
echo "[*] Detected version: ${VERSION:-unknown}"

# Check 1: Look for the APSB26-73 patch fix in ImageContentValidator
VALIDATOR="$MAGENTO_ROOT/vendor/magento/framework/Api/ImageContentValidator.php"
FIX_FOUND=false
if [[ -f "$VALIDATOR" ]]; then
  # The patch adds explicit extension blocking for php/phtml/phar
  if grep -qE 'php|phtml|phar' "$VALIDATOR" 2>/dev/null && grep -qE 'forbidden|blocklist|disallowed.*extension' "$VALIDATOR" 2>/dev/null; then
    echo "[+] ImageContentValidator contains extension restriction (patch indicator)"
    FIX_FOUND=true
  else
    echo "[-] ImageContentValidator lacks extension restriction"
  fi
else
  echo "[?] ImageContentValidator not found at expected path"
fi

# Check 2: Look for option type gating in quote item handling
PROCESSOR="$MAGENTO_ROOT/vendor/magento/module-quote/Model/Quote/Item/Processor.php"
if [[ -f "$PROCESSOR" ]]; then
  if grep -qE 'validateOptionType|isFileOption|optionTypeCheck' "$PROCESSOR" 2>/dev/null; then
    echo "[+] Quote Item Processor contains option type gating (patch indicator)"
    FIX_FOUND=true
  else
    echo "[-] Quote Item Processor lacks option type gating"
  fi
fi

# Check 3: Composer lock for July 2026 security release
if [[ -f "$MAGENTO_ROOT/composer.lock" ]]; then
  if grep -q '2026-jul\|2026\.jul' "$MAGENTO_ROOT/composer.lock" 2>/dev/null; then
    echo "[+] composer.lock references 2026-jul security release"
    FIX_FOUND=true
  fi
fi

# Check 4: Look for existing compromise indicators
echo ""
echo "[*] Scanning for compromise indicators..."
SHELLS_FOUND=0
if [[ -d "$MAGENTO_ROOT/pub/media/custom_options" ]]; then
  SHELLS_FOUND=$(find "$MAGENTO_ROOT/pub/media/custom_options" -name '*.php' -o -name '*.phtml' -o -name '*.phar' 2>/dev/null | wc -l)
  if [[ $SHELLS_FOUND -gt 0 ]]; then
    echo "[!!] COMPROMISE INDICATOR: Found $SHELLS_FOUND PHP files in pub/media/custom_options/"
    find "$MAGENTO_ROOT/pub/media/custom_options" -name '*.php' -o -name '*.phtml' -o -name '*.phar' 2>/dev/null
  fi
fi
BACKDOOR=$(find "$MAGENTO_ROOT/pub" -name 'accesson.php' 2>/dev/null | head -5)
if [[ -n "$BACKDOOR" ]]; then
  echo "[!!] COMPROMISE INDICATOR: accesson.php backdoor found:"
  echo "$BACKDOOR"
fi

# Check 5: Is PHP execution disabled in pub/media? (partial mitigation)
HTACCESS="$MAGENTO_ROOT/pub/media/.htaccess"
PHP_DISABLED=false
if [[ -f "$HTACCESS" ]]; then
  if grep -qi 'php_flag.*engine.*off\|RemoveHandler.*\.php\|deny from all' "$HTACCESS" 2>/dev/null; then
    echo "[+] PHP execution appears disabled in pub/media/ (.htaccess)"
    PHP_DISABLED=true
  fi
fi

echo ""
# Final verdict
if $FIX_FOUND; then
  echo "========================================"
  echo "Result: PATCHED"
  echo "========================================"
  exit 0
else
  echo "========================================"
  if [[ $SHELLS_FOUND -gt 0 ]]; then
    echo "[!!] ACTIVE COMPROMISE DETECTED"
  fi
  if $PHP_DISABLED; then
    echo "[~] Partial mitigation in place (PHP disabled in media dir)"
  fi
  echo "Result: VULNERABLE"
  echo "CVE-2026-48356 (PolyShell) - APSB26-73 patch NOT detected"
  echo "========================================"
  exit 1
fi