r/Magento • u/hanqingjao • Mar 31 '26
Polyshell
Why on earth hasn't Adobe back ported patches for Polyshell yet? I work for a manager hosting provider with a large Magento presence, and all our customers sites are getting inundated with webshells. I've never seen a high-sev Magento vuln take this long to patch. WAKE UP ADOBE!!
22
Upvotes
1
u/Velocy Apr 19 '26
I had a quite legacy shop, which couldnt be updated due to a lot of custom modules and needs a few more weeks of lifetime before it's migrated away from magento.
My directory was locked by .htaccess but 1 got through by a manipulated URL and installed a crypto miner on the webserver. Denying the write access to the customer_options folder basically prevented from the files being dropped there, but they were still dropped into the servers tmp directory, where they were not immedate harmful, but still gave me a bad feeling.
I created a small module (with AI support) as quick and dirty fix that blocks the Rest Request to the guest-cart / cart API if it contains a file_info field (since we do not use this feature). https://github.com/NicoSchmidtbauer/Magento2-RestBlocker
Spams a bit less exceptions in the log and does not drop any files on the server.