Critical BlockStrap flaw could let attackers run code on Magento stores

[Paige_68]

E-commerce security firm Sansec is warning that a maximum severity flaw nicknamed BlockStrap could soon be used against Magento and Adobe Commerce online stores. BleepingComputer's Bill Toulas reports that the bug would let attackers run arbitrary PHP code on store servers. That would give them control of the shop and potentially its customers' data

Affected versions are Adobe Commerce and Magento Open Source up to 2.4.9, and Adobe Commerce B2B up to 1.5.3. Adobe's security bulletin from 13 October rates the fix as priority 2, which suggests patching within 30 days. Sansec thinks that badly understates the risk

Sansec compares BlockStrap with an earlier flaw called StyleSmuggler, which went from hotfix to mass exploitation in just three days. It says it found four possible attack paths for BlockStrap in under 24 hours. It also warns that AI agents could help attackers turn the patch into working exploits very quickly

Technically, BlockStrap is a template injection bug in the email template engine. It exploits a gap left by the earlier StyleSmuggler fix. Store administrators need to install the October release or Adobe's standalone patch, and should keep September's hotfix in place too. No attacks had been seen at the time of writing

Online stores are attractive targets, because a compromised checkout can steal card details from every customer. Waiting 30 days to patch seems risky given how quickly the previous flaw was exploited. Store owners should treat this as urgent

Should Adobe have rated this more urgently? And how quickly do small online shops typically patch?

Critical BlockStrap flaw lets hackers run code on Magento serverswww.bleepingcomputer.com

[James90]

Template engines keep turning up in serious bugs. Letting templates run logic is powerful but risky

Simpler designs might be safer. Logic in templates has caused trouble in many frameworks over the years. Restricting what templates can do is a proven defence

[CosmicRay40]

Card skimming on checkout pages is the usual goal. Customers have no way of knowing a store is compromised. Strong store security protects everyone

[EventHorizon27]

Sansec has been tracking Magento threats for years. When they sound the alarm, it is usually worth listening. Their research is excellent. Their warnings about previous flaws proved accurate

That track record matters. Store owners should take note this time too