Adobe Commerce and Magento Open Source guest cart REST API unrestricted file upload (PolyShell)

#!/usr/bin/env bash
# CVE-2026-48356 (PolyShell) Verification Script
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 3=UNKNOWN
set -uo pipefail

MAGENTO_ROOT="${1:-}"
if [[ -z "$MAGENTO_ROOT" ]]; then
  echo "Usage: $0 /path/to/magento/root"
  echo "UNKNOWN - No Magento root directory specified"
  exit 3
fi
if [[ ! -d "$MAGENTO_ROOT" ]]; then
  echo "UNKNOWN - Directory not found: $MAGENTO_ROOT"
  exit 3
fi
if [[ ! -f "$MAGENTO_ROOT/composer.json" ]]; then
  echo "UNKNOWN - Not a Magento installation (no composer.json)"
  exit 3
fi

echo "=== CVE-2026-48356 (PolyShell) Verification ==="
echo "Magento root: $MAGENTO_ROOT"

# --- Detect version from composer.lock ---
VERSION=""
if [[ -f "$MAGENTO_ROOT/composer.lock" ]]; then
  VERSION=$(python3 -I -c "
import json, sys
with open(sys.argv[1]) as f:
    data = json.load(f)
for pkg in data.get('packages', []):
    if pkg['name'] in ('magento/product-community-edition', 'magento/product-enterprise-edition'):
        print(pkg['version'])
        break
" "$MAGENTO_ROOT/composer.lock" 2>/dev/null || true)
fi
echo "Detected version: ${VERSION:-UNKNOWN}"

VULNERABLE=0
PATCHED=0

# --- Check version string for July 2026+ patch ---
if [[ -n "$VERSION" ]]; then
  if echo "$VERSION" | grep -qiE '2026-(jul|aug|sep|oct|nov|dec)'; then
    echo "[PATCH] Version string contains July 2026+ security patch identifier"
    PATCHED=1
  else
    echo "[INFO] Version $VERSION does not contain 2026-jul+ patch identifier"
  fi
fi

# --- Check for code-level fix in ValidatorFile ---
VALIDATOR="$MAGENTO_ROOT/vendor/magento/module-catalog/Model/Product/Option/Type/File/ValidatorFile.php"
if [[ -f "$VALIDATOR" ]]; then
  if grep -qE 'getAllowedExtensions|validateFileExtension|blockDangerousExtension|extensionBlacklist' "$VALIDATOR" 2>/dev/null; then
    echo "[PATCH] ValidatorFile.php contains file extension validation (patched)"
    PATCHED=1
  else
    echo "[VULN] ValidatorFile.php lacks file extension validation (vulnerable)"
    VULNERABLE=1
  fi
else
  echo "[INFO] ValidatorFile.php not found at expected path; check manually"
fi

# --- Check ImageContentValidator for extension enforcement ---
IMG_VALIDATOR=$(find "$MAGENTO_ROOT/vendor/magento" -path '*/ImageContentValidator.php' -type f 2>/dev/null | head -1)
if [[ -n "$IMG_VALIDATOR" ]]; then
  if grep -qE 'extension|dangerousType|blockPhp' "$IMG_VALIDATOR" 2>/dev/null; then
    echo "[PATCH] ImageContentValidator contains extension checks"
    PATCHED=1
  else
    echo "[VULN] ImageContentValidator lacks extension enforcement"
    VULNERABLE=1
  fi
fi

# --- Server config checks ---
echo ""
echo "=== Server Configuration (RCE mitigation) ==="
MEDIA_DIR="$MAGENTO_ROOT/pub/media"
if [[ -f "$MEDIA_DIR/.htaccess" ]]; then
  if grep -qiE 'php_flag engine off|RemoveHandler.*\.php|SetHandler.*None|deny from all' "$MEDIA_DIR/.htaccess" 2>/dev/null; then
    echo "[OK] .htaccess in pub/media blocks PHP execution"
  else
    echo "[WARN] .htaccess exists but may not block PHP execution"
  fi
else
  echo "[INFO] No .htaccess in pub/media (check nginx config manually)"
fi

# --- IOC scan ---
echo ""
echo "=== IOC Scan ==="
IOC_FOUND=0
CUSTOM_DIR="$MEDIA_DIR/custom_options"
if [[ -d "$CUSTOM_DIR" ]]; then
  PHP_IN_OPTS=$(find "$CUSTOM_DIR" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) 2>/dev/null | head -20)
  if [[ -n "$PHP_IN_OPTS" ]]; then
    echo "[ALERT] PHP files in custom_options/:"
    echo "$PHP_IN_OPTS"
    IOC_FOUND=1
  fi
  POLYGLOT=$(find "$CUSTOM_DIR" -type f -exec grep -rl '<?php' {} + 2>/dev/null | head -10)
  if [[ -n "$POLYGLOT" ]]; then
    echo "[ALERT] Files containing PHP code in custom_options/:"
    echo "$POLYGLOT"
    IOC_FOUND=1
  fi
fi
BACKDOOR=$(find "$MAGENTO_ROOT/pub" -name 'accesson.php' -type f 2>/dev/null | head -5)
if [[ -n "$BACKDOOR" ]]; then
  echo "[ALERT] Known backdoor accesson.php found:"
  echo "$BACKDOOR"
  IOC_FOUND=1
fi
if [[ $IOC_FOUND -eq 0 ]]; then
  echo "[OK] No file-based IOCs found (also check cms_block/cms_page DB tables)"
fi

# --- Verdict ---
echo ""
echo "=== VERDICT ==="
if [[ $PATCHED -eq 1 && $VULNERABLE -eq 0 ]]; then
  echo "PATCHED"
  exit 0
elif [[ $VULNERABLE -eq 1 ]]; then
  echo "VULNERABLE"
  [[ $IOC_FOUND -eq 1 ]] && echo "WARNING: IOCs detected — possible active compromise"
  exit 1
else
  echo "UNKNOWN - Could not definitively determine patch status. Review manually."
  exit 3
fi