DEV Community

Anoymask
Anoymask

Posted on

BlockStrap / CVE-2026-103849: Unauthenticated RCE via Two-Stage Directive Processing in Magento and Adobe Commerce

#security #threatintel

1. Basic Information

This is an unauthenticated remote code execution (RCE) vulnerability evaluated with a CVSS score of 10.0, affecting a wide range of version series in Adobe Commerce and Magento. While Sansec had not confirmed active exploitation in the wild at the time of publication, they reported successfully reproducing four attack vectors in a short timeframe.

2. Brief Summary

A vulnerability in the email template processing of Magento and Adobe Commerce allows unauthenticated remote code execution on the server by hiding directives inside child templates that pass signatures and checks, causing them to be re-interpreted by the parent root template.

3. Attack Flow

Vector 1: BlockStrap Exploiting Two-Stage Directive Processing

  1. An attacker registers values through input forms on the public storefront or other entry points, which are later incorporated into email templates.
  2. The child template containing the attacker-controlled values successfully passes signatures and security checks.
  3. When the output content of the child template is scanned again on the root template side, the hidden block directive inside is interpreted as a valid command.
  4. This reaches objects and methods that are normally not permitted for external calls, executing arbitrary code on the server.

4. Attacker Position and Execution Location

  • An unauthenticated remote attacker who can reach the e-commerce site storefront from the internet.

5. Victim and Administrator Perspective

  • Victims and Users: Because the attack succeeds through input operations identical to normal e-commerce site usage, general users may not see explicit abnormalities or warnings on their screens.
  • Administrators: May observe suspicious requests related to template processing, abnormal generation of email templates, unexpected command launches from PHP worker processes, and unknown file creation within the web root or temporary directories.

6. Success and Failure Conditions

Success Conditions

  • A vulnerable version of Adobe Commerce, Magento Open Source, or Mage-OS is exposed to the internet.
  • During the process where child template contents are re-interpreted by the root template, malicious directives reach the unpatched template processing logic.

Failure Conditions and Countermeasures

  • Apply Adobe's 2026-oct security update or individual isolated patches matching the version series in use. Note that a standard composer install may not apply the fix in some cases. Isolated patches must be applied sequentially, assuming the latest -p release of the target series and past monthly patches have already been applied, and the StyleSmuggler fix patch (VULN-39341) must be maintained without being overwritten. If using Magento Open Source 2.4.6 or earlier, migration to 2.4.7-p10 or later is required, as those versions are eligible for public patches. For Mage-OS, update the entire metapackage to 3.6.0.
  • Until updates are completed, restrict unnecessary template features and publicly exposed endpoints, and monitor child process execution from web and PHP worker processes.

7. What Happens Upon Success

  • Unauthenticated remote code execution (RCE).
  • Potential unauthorized access to or tampering with customer information, order histories, and payment-related data stored and processed on the e-commerce server, as well as the deployment of subsequent payloads such as web shells.

8. Observable Logs

The following are candidates for investigation within your own organization. Data availability depends on product features, permissions, log settings, and retention periods, and the absence of records does not prove an uncompromised state.

  • Email: Although the exploitation targets the email template processing mechanism, phishing emails are not the initial vector. Check internal system logs for suspicious email template generation and transmission history.
  • Proxy / SWG / DNS: Check for repetitive requests targeting storefront template-related endpoints or suspicious parameters containing directive syntax.
  • Endpoint / EDR: Verify records of shells or external utilities launched from PHP or web server processes, unknown file creation, and modifications under the web root.
  • Identity / IdP: Inference: Check for evidence of unauthorized use of administrator sessions or stored credentials after initial intrusion.
  • SaaS / Cloud: In Adobe Commerce Cloud environments, check deployment histories, template modification records, administrator activities, and secret access histories.
  • Network: Check for file downloads, callback communications, and data exfiltration from the e-commerce server to unknown external destinations.

9. Attack Success Assessment

Confirmed in Public Information

  • Initial execution confirmed: Public information: Sansec reproduced RCE via four vectors in their research environment. At the time of publication, neither Sansec nor Adobe had confirmed active exploitation in real-world environments. Code execution reproduction in a research environment must be distinguished from observed attack attempts or real-world damage. Scope: Reproducibility proof in Sansec's research environment (real-world damage and attack attempts unconfirmed)

Separate contact, execution, persistence, information acquisition, and external transmission; do not infer unverified success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Start by investigating the use of vulnerable versions, the absence of the fixing function (resolveDeferredDirectives), suspicious template-related requests, or shell execution from web worker processes.
  • Initial Checks: Confirm the product and version series in use, the application status of the October 2026 security release, the Mage-OS version, and the results reported by patch application plugins.
  • Terminal and Server Investigation: Preserve deployed artifacts, actual Template.php files, process trees, the web root, temporary directories, and template caches.
  • Authentication and Cloud Investigation: Check administrator accounts, API tokens, Commerce Cloud secrets, and payment integration credentials for suspicious usage histories.
  • Subsequent Operations: Track the deployment of web shells or additional payloads, credential theft, access to order and customer data, and data exfiltration.
  • Containment: Restrict unnecessary external exposure paths, update to fixed versions, regenerate template caches, remove suspicious files, and revoke and reissue potentially compromised credentials.
  • Judgment Categories: Evaluate step by step: scanning traffic, delivery of malicious template inputs, re-interpretation of directives, process execution, data access, and external exfiltration.

11. Defense and Detection Ideas

  • Single Event: Detect the launch of shells or download utilities from PHP or web server worker processes with high priority.
  • Timeline Correlation: Correlate storefront template inputs, execution of email template processing, child process launches from web workers, unknown file creation, and outbound communications chronologically.
  • Threat Hunting: Search all Magento and Adobe Commerce environments within the organization for vulnerable versions, the presence of the resolveDeferredDirectives function in actual files, suspicious template modifications, and unknown files under the web root.
  • Log Limitations: Because WAFs and web access logs alone cannot determine the success or failure of two-stage template expansion processing or code execution, application logs must be correlated with host-side EDR and process monitoring logs.
  • Priority Countermeasures: Implement the 2026-oct update or an isolated patch matching the version series while strictly observing prerequisites and application order, and verify that resolveDeferredDirectives exists on actually deployed files. Additionally, maintain the fix patch for StyleSmuggler.

12. Facts, Inference, and Hypothesis

Facts

  • CVE-2026-103849 is a server-side template injection (SSTI) vulnerability in email template processing, evaluated by Adobe with CWE-1336, a CVSS v3.1 score of 10.0, and unauthenticated status.
  • Child templates controlled by an attacker pass signatures and checks, and are then re-interpreted as directives within the root template. This two-stage processing structure bypasses security inspection boundaries.
  • Sansec reproduced four attack vectors and reported reaching code execution within 24 hours of vulnerability disclosure. Active exploitation in real-world environments was not confirmed at the time of publication.
  • Adobe released 2026-oct updates for each version series in APSB26-153 published on October 13, 2026. Published isolated patches target Magento Open Source 2.4.7-p10, 2.4.8-p5, and 2.4.9; users running 2.4.6 or earlier must migrate to a supported version. Mage-OS was fixed in version 3.6.0.
  • Because deployment configurations exist where updating packages via Composer does not reflect patches, Sansec advises directly checking whether resolveDeferredDirectives exists within the target files.
  • Adobe's official KB requires applying the latest -p release of each series and past monthly patches sequentially as a prerequisite for applying isolated patches. Applying 2026-oct is not equivalent to a simple Composer update; patches matching each installed component must be selected and maintained.

Inference

  • In environments using older patch application plugins or partial patch applications, vulnerable code fragments (hunks) may remain even if dependency updates in Composer succeed; therefore, one must verify not only package version numbers but also the presence of the fix function and directly inspect deployed files.

Hypothesis

No additional hypotheses. Unverified items are listed under "Unknowns and Additional Investigation".

13. MITRE ATT&CK Mappings

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high A vulnerability leading to remote code execution by abusing unauthenticated template processing mechanisms on an externally exposed storefront. Source

14. Unknowns and Additional Investigation

  • Specific input endpoints for all four attack vectors whose reproduction was confirmed by Sansec, exploit stability in production environments, and the presence of active exploitation after disclosure could not be confirmed at this time.

15. Impact on SOCs and Organizations

For organizations running Magento or Adobe Commerce, these platforms connect payment processing with customer data. It is critical to urgently apply security patches, check for missing patch applications in CI/CD build pipelines, monitor for suspicious template modifications and shell launches from web servers, and avoid considering patch deployment complete solely based on package version checks in Composer.

16. Summary by Target Audience

  • For SOCs: Correlate and monitor template modifications around the time of vulnerability disclosure, suspicious email template inputs, shell launches from web/PHP workers, and unknown file creation.
  • For Administrators: After meeting the prerequisites for each version series, apply the 2026-oct update or isolated patches, and update Mage-OS to 3.6.0. Do not assume regular Composer updates are sufficient; verify that resolveDeferredDirectives is included in actually deployed files.
  • For Users: This is a server-side vulnerability that does not require user action. If you receive password change or re-authentication notices from the e-commerce site you are using, follow their instructions.

Top comments (0)