Critical Alert: PolyShell/SessionReaper Wipes Magento 2 Product Data – Your Guide to Defense

Critical Alert: PolyShell/SessionReaper Wipes Magento 2 Product Data – Your Guide to Defense

The digital storefronts powered by Magento are prime targets for cybercriminals, and a recent, highly sophisticated attack campaign has sent shockwaves through the community. A critical GitHub issue (#41016) brought to light by nisamudeen97 details a devastating PolyShell/SessionReaper attack specifically targeting Magento 2.4.x installations. This isn't just another breach; it's a calculated assault leading to complete product data annihilation and the persistent injection of insidious backdoors.

The Devastating Impact: Data Loss and Persistent Backdoors

The most alarming symptom of this attack is the inexplicable and complete deletion of all product records from the catalog_product_entity table. While categories and media files often remain untouched, this selective data destruction points to a highly targeted and potentially intentional act of sabotage. Imagine your entire product catalog vanishing overnight – a nightmare scenario for any e-commerce business.

Beyond data loss, the attack leaves a trail of widespread infection across the document root, indicating a deep compromise:

• Webshells Galore: Files like filefuns.php were found in numerous pub folders, alongside multiple PHP webshells strategically placed within pub/media/custom_options/quote/. These provide attackers with remote control over your server.
• Hidden Directories: A cunningly nested pub/images/images/images/ directory containing cache.php suggests an attempt to hide malicious files in plain sight.
• Infected Core Files: A compromised pub/health_check.php indicates an attempt to inject malicious code into seemingly legitimate system files.
• Root-Level Backdoors: A suspicious pub/a3d18861c4dd.php file at the root level serves as a persistent entry point for attackers.

Further alarming findings included modifications to the .htaccess file, a critical server configuration file. Such modifications can be used to redirect traffic, bypass security rules, or serve malicious content, making detection and removal even more challenging.

Tracing the Attack: PolyShell and SessionReaper Connections

The detailed investigation by the issue reporter, referencing Sansec.io's research on PolyShell and SessionReaper, provides crucial insights. PolyShell is known for its ability to evade detection by using polymorphic code, making each instance of the malware unique. SessionReaper, on the other hand, specializes in hijacking active user sessions, often exploiting vulnerabilities in how sessions are managed.

Evidence linking this incident to these sophisticated campaigns includes:

• Access attempts from specific IP ranges (e.g., 162.159.113.0/24) identified in Sansec's research.
• The presence of specific file names and patterns consistent with known PolyShell/SessionReaper infections.

The attack vector appears to involve the anonymous upload of files via endpoints like /customer/address_file/upload. Although this link might now show a 404 error, the attacker successfully exploited it, likely triggering a 500 error after PHP execution. Auditd logs revealed suspicious activity in media/customer_address/s/e/sess_xhra9mhp6setxga35eua5nuc1glxuqmv just before the creation of the ./pub/a3d18861c4dd.php backdoor.

A key observation was a PUT request from an observed attack IP address (141.101.98.167):

PUT /rest/V1/guest-carts/172/order https://webxxxxx.com.co.uk/customer/address_file/upload

This suggests a potential weaponization of the guest-carts API in conjunction with a file upload vulnerability, allowing attackers to inject and execute malicious code, ultimately leading to the database wipe and backdoor deployment.

Immediate Actions for Affected Magento Stores

If you suspect your Magento 2.4.x store has been compromised by a PolyShell/SessionReaper attack, immediate and decisive action is paramount:

1. Isolate and Backup: Take your store offline immediately and create a full backup of your database and files. This is crucial for forensic analysis and recovery.
2. Forensic Analysis: Engage a cybersecurity expert to perform a thorough forensic analysis. Identify the initial point of compromise, all injected files, and any modified database entries.
3. Manual Cleanup: Systematically remove all identified webshells, backdoors, and modified files. Pay close attention to .htaccess files, core Magento files (like health_check.php), and any suspicious files in pub/media/ or the document root.
4. Database Restoration: Restore your catalog_product_entity table from a clean, pre-infection backup. If no clean backup exists, manual re-entry or data reconstruction may be necessary.
5. Password Resets: Force a password reset for all admin users, database users, and hosting accounts.

Proactive Defense Strategies for Magento 2.4.x

Prevention is always better than cure. As e-commerce migration experts at Shopping Mover, we emphasize that a robust security posture is non-negotiable, especially when considering a Magento migration or upgrade. Here’s how to fortify your store:

1. Stay Updated: Patching is Paramount

The most critical defense is keeping your Magento/Adobe Commerce installation, extensions, and server software (PHP, MySQL, Apache/Nginx) fully up-to-date. While the specific Adobe security patches addressing the /customer/address_file/upload and guest-carts session weaponization for Magento 2.4.8 are not explicitly detailed in the issue, it is imperative to apply all available security patches and hotfixes released by Adobe. Regularly check the official Magento security center for advisories.

2. Implement Strong Security Best Practices

• Web Application Firewall (WAF): Deploy a robust WAF (e.g., Cloudflare, Sucuri) to filter malicious traffic and protect against common attack vectors.
• File Integrity Monitoring (FIM): Use FIM tools to detect unauthorized changes to your Magento core files and critical directories in real-time.
• Least Privilege Principle: Ensure all users, applications, and services operate with the minimum necessary permissions. Disable PHP execution in upload directories (e.g., pub/media).
• Strong Passwords & 2FA: Enforce complex passwords and multi-factor authentication (2FA) for all admin accounts.
• Disable Unnecessary Modules: Remove or disable any Magento modules or extensions that are not actively used.

3. Server Hardening and Monitoring

• Auditd Configuration: As demonstrated in the GitHub issue, configuring auditd on your hosting server is invaluable for tracking file creations and modifications, helping to pinpoint the source of new infections.
• Restricted File Permissions: Implement strict file and directory permissions (e.g., 644 for files, 755 for directories, 777 only for specific writable directories like var and pub/media, and even then, with caution).
• Regular Log Analysis: Actively monitor Apache/Nginx access logs, Magento system logs, and security logs for suspicious activity, unusual IP addresses, or repeated error messages.
• Security Audits: Conduct regular security audits and penetration testing by certified professionals to identify vulnerabilities before attackers do.

Conclusion: Vigilance is Your Best Defense

The PolyShell/SessionReaper attack on Magento 2.4.x is a stark reminder of the evolving threat landscape in e-commerce. The complete wipe of product data and the stealthy injection of backdoors highlight the need for continuous vigilance and a proactive security strategy. For businesses considering a Magento migration, this incident underscores the importance of building a secure foundation from the ground up. At Shopping Mover, we advocate for comprehensive security assessments as an integral part of any migration project, ensuring your new platform is not just faster and more efficient, but also impenetrable.

Stay informed, stay patched, and stay secure. Your e-commerce future depends on it.