Why this matters
Adobe’s latest security bulletin reveals a template‑engine bug that can turn a crafted email into a PHP shell on Magento Open Source and Adobe Commerce installations.
Technical specifics
The flaw, dubbed BlockStrap, resides in the second‑pass processing of the {{block}} directive inside email templates. An attacker who can influence the template content can inject a directive that the engine evaluates a second time, effectively executing arbitrary PHP code on the server.
Adobe classifies the issue as an “improper neutralization of special elements in a template engine” (CWE‑74). The vulnerability affects Magento Open Source up to version 2.4.9 and Adobe Commerce (including B2B) up to version 1.5.3.
Potential attack paths
Sansec’s rapid analysis identified four plausible routes:
- Manipulating a marketing email template that is later rendered by the platform.
- Abusing a custom module that loads external template files.
- Leveraging a third‑party extension that permits user‑supplied template fragments.
- Injecting the {{block}} directive through a compromised admin account.
Who is affected
Any organization running the vulnerable Magento or Adobe Commerce versions is in scope. The flaw does not require a separate vulnerability to reach code execution – control of an email template is sufficient.
Defensive steps
Apply Adobe’s October 13 patch immediately. The update replaces the generic template processor with a whitelist of registered placeholders, blocking the second‑pass injection.
While you wait for the patch, mitigate risk by:
- Restricting who can edit email templates and auditing recent changes.
- Disabling or removing unused third‑party extensions that load external templates.
- Scanning for unexpected {{block}} directives in existing templates.
- Ensuring admin accounts use strong, unique passwords and MFA.
After patching, verify that the “BlockStrap” fix is active and monitor Adobe’s advisory for any follow‑up guidance.