Skip to content

Releases

magescan 0.4.0

magescan 0.4.0 Latest
Latest

Choose a tag to compare

View all tags
@Genaker Genaker released this 12 Sep 06:48
v0.4.0
4f9667e

Detections for the CVE-2026-75650 / APSB26-146 post-exploitation pattern (stolen integration token + CMS template-directive probing), plus Adobe Commerce Cloud log support.

New (12 rules, 31 → 43)

Database (magescan db)

  • cms-block-template-directive-rce, cms-page-template-directive-rce — {{block … output=getModuleName}} and {{layout handle=…]|*[…}} code-exec probes; silent on normal {{widget}}/template= content
  • integration-fullaccess-token-stale — full-access integration token >90 days old, never rotated
  • oauth-token-orphan — token whose integration was deleted (can't be reauthorized from the admin)
  • integration-bearer-enabled, admin-weak-security-config, payment-secret-plaintext, config-secret-oldest-key

Logs (magescan logs) — now reads Adobe Commerce Cloud /var/log/platform/*/access.log* (previously only nginx/apache paths, so Cloud exploit requests were missed)

  • log-cmsblock-api-abuse — POST/PUT/DELETE bursts to /rest/V1/cmsBlock|cmsPage
  • log-admin-token-bruteforce — hammering of /rest/V1/integration/admin/token
  • log-exploit-tool-upload — python-requests upload probing / styles[generatorClass]; legit ERP python-requests traffic not matched

System (magescan system)

  • php-in-php-tmpdir — PHP polyglots left in /tmp/<project> by rejected uploads

Run

curl -fsSL https://github.com/Genaker/magescan/releases/latest/download/magescan-linux-amd64 -o /tmp/magescan && chmod +x /tmp/magescan && /tmp/magescan all -root /var/www/magento -format table
Assets 11
Loading

magescan 0.3.0

magescan 0.3.0

Choose a tag to compare

View all tags
@Genaker Genaker released this 10 Sep 22:15
v0.3.0
8ddf1c5

Read-only, rule-driven compromise scanner for Magento 2 / Adobe Commerce. One static binary — nothing to install on the server.

Run it

On the server:

curl -fsSL https://github.com/Genaker/magescan/releases/latest/download/magescan-linux-amd64 -o /tmp/magescan && chmod +x /tmp/magescan && /tmp/magescan all -root /var/www/magento -format table

Over SSH from your machine:

ssh user@host 'curl -fsSL https://github.com/Genaker/magescan/releases/latest/download/magescan-linux-amd64 -o /tmp/magescan && chmod +x /tmp/magescan && /tmp/magescan all -root /var/www/magento -format table'

Verify: curl -fsSL https://github.com/Genaker/magescan/releases/latest/download/SHA256SUMS | sha256sum --ignore-missing -c -

What's in 0.3.0

  • Commands per scanner: files, db, system, logs, all (default), plus rules list|validate
  • 31 embedded rules in rules/{files,db,system,logs}/: upload-dir PHP and filter-bypass names, webshell code, PHP-enabling .htaccess / .user.ini, session-file poisoning, path-traversal names, CMS/config/widget/email/banner skimmers, layout-XML injection, recent admins/integrations, CVE-2026-75650 implants and exploit requests, suspicious processes and cron
  • DB credentials discovered from app/etc/env.php; every query validated as SELECT and run in a READ ONLY session
  • Report formats: text, table, json, jsonl, csv, md, html (-o report.html picks the format from the extension; refused inside the store root)
  • Parallel file walk (-threads, default 2), progress heartbeat for detached runs
  • Drop-in rules without rebuilding (-rules dir); every embedded rule has match / no-match test cases

Assets

file for
magescan-linux-amd64 most Magento servers, Adobe Commerce Cloud
magescan-linux-arm64 ARM / Graviton
magescan-darwin-arm64, magescan-darwin-amd64 macOS (local testing, rule authoring)
magescan-0.3.0-* same binaries, versioned names for pinning
SHA256SUMS checksums
Loading