module

Magento SessionReaper

Try Surface Command
Back to search
Disclosed
Oct 22, 2025
Created
Dec 10, 2025

Description

This module exploits CVE-2025-54236 (SessionReaper), a critical vulnerability in
Magento/Adobe Commerce that allows unauthenticated remote code execution.

The vulnerability stems from improper handling of nested deserialization in the
payment method context, combined with an unauthenticated file upload endpoint.

The exploit chain consists of three steps:
1. Upload a malicious PHP session file containing a Guzzle/FW1 deserialization
payload via the unauthenticated /customer/address_file/upload endpoint
2. Trigger deserialization by sending a crafted JSON payload to the REST API
endpoint /rest/default/V1/guest-carts/{cart_id}/order that modifies the
session savePath to point to the uploaded file
3. Execute the uploaded PHP code to gain remote code execution

This vulnerability affects Magento 2.x instances configured to use file-based
session storage. Patched versions will return a 400 Bad Request response instead
of processing the malicious payload.

Authors

Blaklis
Tomais Williamson
Valentin Lobstein [email protected]

Platform

Linux,PHP,Unix,Windows

Architectures

php, cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/multi/http/magento_sessionreaper
    msf exploit(magento_sessionreaper) > show targets
        ...targets...
    msf exploit(magento_sessionreaper) > set TARGET < target-id >
    msf exploit(magento_sessionreaper) > show options
        ...show and set options...
    msf exploit(magento_sessionreaper) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today