Description
This module exploits CVE-2025-54236 (SessionReaper), a critical vulnerability in Magento/Adobe Commerce that allows unauthenticated remote code execution.
The vulnerability stems from improper handling of nested deserialization in the payment method context, combined with an unauthenticated file upload endpoint.
The exploit chain consists of three steps: 1. Upload a malicious PHP session file containing a Guzzle/FW1 deserialization payload via the unauthenticated /customer/address_file/upload endpoint 2. Trigger deserialization by sending a crafted JSON payload to the REST API endpoint /rest/default/V1/guest-carts/{cart_id}/order that modifies the session savePath to point to the uploaded file 3. Execute the uploaded PHP code to gain remote code execution
This vulnerability affects Magento 2.x instances configured to use file-based session storage. Patched versions will return a 400 Bad Request response instead of processing the malicious payload.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/magento/sessionreapermsf undefined(sessionreaper) > show actions ...actions...msf undefined(sessionreaper) > set ACTION < action-name >msf undefined(sessionreaper) > show options ...show and set options...msf undefined(sessionreaper) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub