Critical Alert: Magento 2.4.x Stores Under Siege by PolyShell/SessionReaper Attack

Unmasking a Critical Threat: PolyShell/SessionReaper Targets Magento 2.4.x Stores

The e-commerce landscape is constantly under threat, and a recent GitHub issue (#41016) has brought to light a particularly insidious attack campaign affecting Magento 2.4.x installations. Reported by user nisamudeen97, this issue details a sophisticated PolyShell/SessionReaper attack that has led to devastating consequences, including the complete wipe of product data and the persistent injection of backdoors.

The Devastating Impact: Data Loss and Persistent Backdoors

The core of the problem revolves around the inexplicable deletion of all product records from the catalog_product_entity table, leaving categories and media files untouched. This selective data destruction points to a highly targeted and potentially intentional sabotage. Beyond data loss, multiple suspicious files were discovered across the document root, indicating a widespread infection:

• Webshells: Files like filefuns.php found in numerous pub folders, and multiple PHP webshells within pub/media/custom_options/quote/.
• Hidden Directories: A nested pub/images/images/images/ directory containing cache.php.
• Infected Core Files: A compromised pub/health_check.php.
• Root-Level Backdoors: A suspicious pub/a3d18861c4dd.php file at the root level.

Further alarming findings included modifications to the .htaccess file, suggesting attempts to manipulate server behavior or redirect traffic maliciously.

Tracing the Attack: PolyShell and SessionReaper Connections

The reporter's detailed investigation, referencing Sansec.io's research on PolyShell and SessionReaper attacks, revealed critical clues. Observed access attempts from specific IP ranges, consistent with those linked to known PolyShell campaigns (e.g., 162.159.113.0/24), helped solidify the diagnosis. Auditd logs provided a timeline, showing the creation of ./pub/a3d18861c4dd.php coinciding with suspicious activity in media/customer_address/.

The primary attack vector appears to exploit vulnerabilities related to file uploads and session handling. Specifically, an anonymous user was observed leveraging https://webxxxxx.com.co.uk/customer/address_file/upload and a PUT /rest/V1/guest-carts/172/order request from an attack IP (141.101.98.167) to inject malicious files. While the upload link later showed a 404 error, it seemingly functioned during the attack, resulting in a 500 error after PHP execution, indicative of a successful payload delivery.

The Challenge of Persistence

Despite manual cleanup efforts and the implementation of auditd for monitoring, the malware files reappeared the very next day. While the database wipe did not recur in the subsequent attack, the persistence highlights the sophistication of the threat actors and the difficulty in fully eradicating such infections without addressing the root vulnerability.

Unanswered Questions and the Call for Community Vigilance

The original issue raises crucial questions for the Magento community:

• Have other Magento 2.4.x users experienced similar catalog_product_entity table wipes as part of this PolyShell/SessionReaper campaign?
• Is the data wipe an intentional act of sabotage or an unintended consequence of a failed SQL injection?
• Which specific Adobe security patches or hotfixes address the /customer/address_file/upload and guest-carts session weaponization vulnerabilities in Magento 2.4.8?

Important Note: The provided source material for this insight consisted solely of the initial GitHub issue description. No comments, community discussions, or official solutions from Adobe were available within the scope of this analysis. Therefore, this insight focuses on detailing the reported threat and the critical questions it raises for the Magento ecosystem.

For Magento merchants and developers, this serves as a stark reminder of the importance of robust security practices, regular patching, comprehensive monitoring, and proactive vulnerability assessments. Staying informed about emerging threats like PolyShell/SessionReaper is paramount to protecting your e-commerce operations.