Important: While the JetRails "Secure by Default" architecture prevents these files from being executed on our servers, the underlying vulnerability that allows uploads via the Magento REST API remains active. Until Adobe releases a formal patch, we recommend following the mitigation steps below to ensure uploaded files remain neutralized.
At JetRails, we are closely monitoring the "Polyshell" attack vector recently detailed by Sansec. This advisory provides a clear breakdown of the risk and how to determine if your specific Magento configuration is affected.
What is the Magento Polyshell?
In simple terms, a Polyshell is a malicious script disguised as a harmless image. An attacker attempts to upload this file through a storefront's Custom Product Options (specifically the "File" upload type). Once uploaded, the attacker tries to execute the hidden code to gain control of the server.
The Bottom Line:
If you do not use "File" type custom options for any products, you are not affected.
If you do use file uploads for products, you must wait for an official patch, as blocking the upload path will prevent your customers from placing orders.
The exploit can be triggered on products without custom options; just a random SKU is enough.
The JetRails Safeguard
JetRails customers benefit from a "Secure by Default" architecture. Regardless of whether you use custom options:
Execution Blocking: Our server configurations are designed to block the execution of arbitrary files within media and upload directories.
Neutralization: Even if a Polyshell is successfully uploaded, it is stored as a static file. Our environment prevents the server from "running" the code hidden inside it.
How to Check if You Are Affected
To confirm if your store uses the "File" upload custom option, run the following SQL query against your database. This will list any products currently configured to accept file uploads from customers:
SELECT
cpe.sku AS product_sku,
cpot.title AS option_title,
cpo.type AS option_type
FROM catalog_product_option cpo
JOIN catalog_product_entity cpe
ON cpo.product_id = cpe.entity_id
LEFT JOIN catalog_product_option_title cpot
ON cpo.option_id = cpot.option_id AND cpot.store_id = 0
WHERE cpo.type = 'file';Recommended Mitigation Strategies
Scenario A: You DO NOT Use Product File Uploads
If the query above returns no results, for additional security, you can block the /media/custom_options/ directory. This adds an extra layer of "Edge" security.
1. Cloudflare WAF Configuration: To block these requests at the edge:
Log in to your Cloudflare Dashboard.
Navigate to Security > WAF > Custom rules.
Click Create rule.
Set the Rule name to "Block Polyshell Upload Path".
-
Under When incoming requests match, set:
Field:
URI Path| Operator:equals| Value:/media/custom_options/Click And
Field:
Request Method| Operator:equals| Value:POST
Under Then take action, select Block.
Click Deploy.
2. Nginx Configuration Block To ensure the server itself rejects these requests, the following can be added to your Nginx configuration:
location ~* ^/media/custom_options/ {
deny all;
}Scenario B: You DO Use Product File Uploads
If you require these uploads for your business, do not apply the blocks mentioned above, as they will break your store's functionality.
Rely on JetRails: Our server-level restrictions are already in place to prevent uploaded files from being executed.
Apply Patches: Monitor Adobe/Magento for an official security patch to address the underlying validation logic.
[!IMPORTANT] Need Assistance? The JetRails team is here to help. If you would like us to verify your database, implement the Nginx block, or configure the Cloudflare WAF rule for you, please reach out to our support team.