## https://sploitus.com/exploit?id=FBA8D7C9-BDAA-5FE8-B1F1-5C0F0323213E
# CVE-2026-75650 / VULN-39341 Docker validation lab
This standalone lab reproduces the StyleSmuggler **component-level PHP execution
primitive** on a revision-pinned Magento Open Source 2.4.9 checkout and then
proves that Adobe's VULN-39341 patch blocks the identical input.
The proof is non-destructive: included PHP can only write one random marker in
`/tmp`. It cannot run a command, download a file, open a callback, or accept an
operator-supplied payload.
## Scope and claim
The lab provides:
- a stock Magento 2.4.9 Docker stack pinned to Git revision
`755e34dd689021c5165db9d35ecff74f7dc51527`;
- a vulnerable/patched A/B for harmless report storage and component execution;
- the checksum-pinned 2.4.9 VULN-39341 monorepo patch;
- a read-only Docker validator for an owner-controlled Magento filesystem.
The lab does **not** claim a stock unauthenticated HTTP exploit. The component
probe starts at the real email-template model, so it proves the dangerous sink
and the patch boundary, not the missing network-to-template connector. No
synthetic HTTP route is added.
## Safety and requirements
Use only on systems you own or are explicitly authorized to test. Do not place
the PHP probe under a production web root. For a real installation, use the
read-only validator or validate a disposable staging clone.
Requirements:
- Docker with Compose v2;
- approximately 6 GB free RAM and 5 GB free disk;
- outbound access during first build and installation.
Only the developer-mode storefront gateway is published, and only on loopback
(`127.0.0.1:8096` by default). A second unexposed nginx gateway selects standard
production error handling so the report test receives Magento's normal report
identifier. MariaDB, Redis, OpenSearch, PHP-FPM, and that report gateway are not
exposed to the host network.
## Quick start
```bash
cd docker-lab
cp .env.example .env
docker compose up -d --build
docker compose logs -f php
```
The initial Magento clone, dependency install, and application install normally
take 15–40 minutes. When the PHP log prints `Ready`, run:
```bash
docker compose exec -T php bash /lab/scripts/run-ab.sh
```
Or use the convenience targets:
```bash
make up
make wait
make ab
```
The A/B command always attempts to leave the source in the patched state.
## Required result
The test passes only when both independently tested halves behave as expected:
```text
Unpatched report: raw-tag=true, guard=false
Patched report: raw-tag=false, guard=true, neutralized=true
Unpatched component: marker=true
Patched component: marker=false
[PASS] Report storage and component execution match the required A/B controls.
```
An HTTP 200, rendered notification, generated error report, or thrown exception
is not accepted as execution proof. The report and execution checks remain
separate: their joint success does not invent the unproven stock HTTP connector.
## Manual A/B controls
```bash
make vulnerable
make report # expected: raw tag preserved, no execution guard
make probe # expected: execution_observed=true and exit 0
make patched
make report # expected: exit guard present, payload tag neutralized
make probe # expected: execution_observed=false and exit 2
```
`make probe` returning 2 in the patched state is the expected negative result;
`make ab` handles both exit statuses and returns 0 only when the full A/B passes.
## Validate an owner-controlled Magento tree
This check never starts Magento or executes code from the mounted tree. The
container has no network, no Linux capabilities, a read-only root filesystem,
and a read-only target mount.
```bash
make validate TARGET=/absolute/path/to/magento
```
Expected fully patched verdict:
```text
Summary: 9/9 controls present
Verdict: FULL_CONTROL_SET_PRESENT
```
Anything less is reported as `FULL_CONTROL_SET_NOT_CONFIRMED`, not automatically
as exploitable. Confirm the exact Commerce edition/version and apply Adobe's
version-matched patch through its supported deployment process.
## What “marker-only component RCE probe” means
- **Marker-only:** the fixed PHP payload writes one nonce-bound temporary file.
It has no shell, command, downloader, web shell, or network callback.
- **Component:** the probe feeds the graph directly into Magento's real
email-template model. It does not arrive through a public web endpoint.
- **RCE probe:** the marker is an independent side effect proving PHP code ran in
the application process. “RCE” describes the impact of a remotely reachable
sink; this probe alone does not prove the remote reachability link.
The more exact name is **marker-only component code-execution probe**. End-to-end
remote RCE requires a stock remote request to produce its own independent marker
or callback on the tested build.
See [Technical notes](docs/TECHNICAL-NOTES.md) for the data flow, nine patch
controls, and the proof-strength table. The exact tested results are recorded in
[VALIDATION.md](VALIDATION.md).
## Production remediation
Use the official bulletin and the patch matching the deployed release:
-
-
-
The patch embedded here is path-mapped only for the public 2.4.9 monorepo lab.
Do not apply it directly to a production Composer installation. Patching also
does not remove an already present implant or restore exposed credentials.
## Cleanup
```bash
make down # preserve volumes
make reset # delete this lab's source, database, and OpenSearch volumes
```
## License
Lab-authored material is MIT licensed. See [LICENSE](LICENSE) and the upstream
patch attribution in [NOTICE.md](NOTICE.md).