README

Caution

This is an unofficial stop-gap, not an official Adobe patch, and it carries no warranty. See the LICENSE.

It hardens three points on the StyleSmuggler chain: the email template {{block}} directive instantiates only allowlisted block classes and nothing is allowlisted by default, the grid row URL generator factory validates the class before building it, and Web API fatal error reports have their PHP open tags broken. That is hardening, not a fix — the vulnerability itself is unpatched, and other paths through it remain open.

A vulnerable store may already be compromised. Mitigating an entry point does not remove a backdoor that is already there. Audit your store.

The mitigation will change as better fixes are found. Read the CHANGELOG before every upgrade. Test on a staging environment first. Have a rollback plan.

Magento Version Support

Purpose

This repo creates a stop-gap patch for the Style Smuggler vulnerability. It's purely mitigation. It likely isn't perfect, but it's my current best assessment of how to mitigate the vulnerability.

This package will change versions as I trial different layers of fixes to the vulnerability.

Getting Started

This module is intended to be installed with composer. From the root of your Magento 2 project:

Download the package

composer require graycore/magento2-style-smuggler-patch

Enable the package

./bin/magento module:enable Graycore_StyleSmugglerPatch

Check your logs for refused blocks

The {{block}} email template directive can no longer instantiate any block class. If your transactional emails need one, the refusal is logged as critical with the class name, so run a test send and read var/log/system.log before going live:

Refused a block class in an email template {{block}} directive because it is not on the allowlist. {"class":"Vendor\\Module\\Block\\OrderSummary"}

Allowlisting a Block Class

Add the classes your email templates need from your own module's di.xml:

<type name="Graycore\StyleSmugglerPatch\Model\Template\BlockDirectiveAllowList">
    <arguments>
        <argument name="allowedClasses" xsi:type="array">
            <item name="order_summary" xsi:type="string">Vendor\Module\Block\OrderSummary</item>
        </argument>
    </arguments>
</type>

Then bin/magento cache:clean config (or setup:di:compile in production mode).

A few things to know:

Matching is on the exact class name, so a subclass of an allowlisted class is not itself allowlisted. Separator spelling, leading separators and case do not matter.
Backend blocks — anything under Magento\Backend\Block\ or a \Block\Adminhtml\ namespace — are refused even if you allowlist them.
The list lives on the filesystem rather than in store configuration on purpose: widening it should take a deploy, not admin or database access.
{{block id="..."}} is untouched. It names no class for Magento to resolve; core renders a CMS block by id.

Upgrading

Semver Policy

graycore / magento2-style-smuggler-patch

Package info

Security

Fund package maintenance!

Statistics