Adobe Commerce / Magento Open Source Server-Side Template Injection (StyleSmuggler) Unauthenticated RCE

#!/usr/bin/env bash
# CVE-2026-75650 (StyleSmuggler) Vulnerability Check
# Checks whether the Magento/Adobe Commerce installation is patched against CVE-2026-75650.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

MAGENTO_ROOT="${1:-.}"
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'

# Verify Magento root
if [[ ! -f "${MAGENTO_ROOT}/composer.json" ]] || [[ ! -d "${MAGENTO_ROOT}/app/etc" ]]; then
    echo -e "${YELLOW}UNKNOWN${NC} — ${MAGENTO_ROOT} does not appear to be a Magento root directory."
    exit 2
fi

# Detect edition and version
VERSION=""
EDITION="unknown"
if grep -q 'magento/product-enterprise-edition' "${MAGENTO_ROOT}/composer.json" 2>/dev/null; then
    EDITION="Adobe Commerce"
    VERSION=$(grep -oP '"magento/product-enterprise-edition"\s*:\s*"\K[^"]+' "${MAGENTO_ROOT}/composer.json" 2>/dev/null || true)
elif grep -q 'magento/product-community-edition' "${MAGENTO_ROOT}/composer.json" 2>/dev/null; then
    EDITION="Magento Open Source"
    VERSION=$(grep -oP '"magento/product-community-edition"\s*:\s*"\K[^"]+' "${MAGENTO_ROOT}/composer.json" 2>/dev/null || true)
fi

if [[ -z "$VERSION" ]] && [[ -x "${MAGENTO_ROOT}/bin/magento" ]]; then
    VERSION=$("${MAGENTO_ROOT}/bin/magento" --version 2>/dev/null | grep -oP '\d+\.\d+\.\d+(-p\d+)?' || true)
fi

if [[ -z "$VERSION" ]]; then
    echo -e "${YELLOW}UNKNOWN${NC} — Could not determine Magento version."
    exit 2
fi

echo "Detected: ${EDITION} ${VERSION}"

# Check for hotfix VULN-39341 / APSB26-146
HOTFIX_FOUND=false
HOTFIX_SOURCE=""

# Method 1: composer.lock or composer.json references
for f in "${MAGENTO_ROOT}/composer.json" "${MAGENTO_ROOT}/composer.lock"; do
    if [[ -f "$f" ]] && grep -qiE 'VULN-39341|APSB26-146|CVE-2026-75650' "$f" 2>/dev/null; then
        HOTFIX_FOUND=true
        HOTFIX_SOURCE="composer reference in $(basename $f)"
    fi
done

# Method 2: m2-hotfixes directory
if [[ -d "${MAGENTO_ROOT}/m2-hotfixes" ]]; then
    if ls "${MAGENTO_ROOT}/m2-hotfixes/"*39341* 2>/dev/null | grep -q . || \
       ls "${MAGENTO_ROOT}/m2-hotfixes/"*75650* 2>/dev/null | grep -q .; then
        HOTFIX_FOUND=true
        HOTFIX_SOURCE="m2-hotfixes directory"
    fi
fi

# Method 3: Check patch application logs
for patchlog in "${MAGENTO_ROOT}/var/.patch"/* "${MAGENTO_ROOT}/var/log/patch"*; do
    if [[ -f "$patchlog" ]] && grep -qiE 'VULN-39341|APSB26-146|CVE-2026-75650' "$patchlog" 2>/dev/null; then
        HOTFIX_FOUND=true
        HOTFIX_SOURCE="patch log $(basename $patchlog)"
    fi
done

# Method 4: Check the Template Filter source for the fix signature
FILTER_FILE="${MAGENTO_ROOT}/vendor/magento/framework/Filter/Template.php"
if [[ -f "$FILTER_FILE" ]]; then
    if grep -qE 'sanitizeDirective|stylesSanitize|VULN.39341|neutralizeTemplateDirectives' "$FILTER_FILE" 2>/dev/null; then
        HOTFIX_FOUND=true
        HOTFIX_SOURCE="patched Template.php"
    fi
fi

if $HOTFIX_FOUND; then
    echo -e "${GREEN}PATCHED${NC} — Hotfix VULN-39341 (APSB26-146) detected via ${HOTFIX_SOURCE}."
    exit 0
fi

# Parse version components
BASE_VER=$(echo "$VERSION" | grep -oP '^\d+\.\d+\.\d+')
if [[ -z "$BASE_VER" ]]; then
    echo -e "${YELLOW}UNKNOWN${NC} — Could not parse version: ${VERSION}"
    exit 2
fi

IFS='.' read -r MAJ MIN PATCH <<< "$BASE_VER"

# Affected range: 2.4.4 through 2.4.9
if (( MAJ == 2 && MIN == 4 && PATCH >= 4 && PATCH <= 9 )); then
    echo -e "${RED}VULNERABLE${NC} — ${EDITION} ${VERSION} is in the affected range (2.4.4–2.4.9)."
    echo "Hotfix VULN-39341 (APSB26-146) was NOT detected."
    echo "Apply immediately: https://experienceleague.adobe.com/en/docs/commerce-knowledge-base/kb/announcements/commerce-apsb26-146"
    # Also check for IOCs
    echo ""
    echo "=== Quick IOC scan ==="
    if find "${MAGENTO_ROOT}/pub/media/" -name '*.php' -newer "${MAGENTO_ROOT}/composer.json" 2>/dev/null | head -5 | grep -q .; then
        echo -e "${RED}WARNING:${NC} PHP files found in pub/media/ — possible webshell"
        find "${MAGENTO_ROOT}/pub/media/" -name '*.php' -newer "${MAGENTO_ROOT}/composer.json" 2>/dev/null | head -10
    fi
    if grep -r 'Laminas.Loader.Exception.InvalidArgumentException' "${MAGENTO_ROOT}/var/log/exception.log" 2>/dev/null | head -1 | grep -q .; then
        echo -e "${RED}WARNING:${NC} StyleSmuggler exploitation signature found in exception.log"
    fi
    exit 1
else
    echo -e "${YELLOW}UNKNOWN${NC} — ${EDITION} ${VERSION} is outside the documented affected range (2.4.4–2.4.9). Verify manually."
    exit 2
fi