Tomais Williamson

Metasploit · Author

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

Metasploit

Magento SessionReaper

Metasploit exploitby BlaklisAdded to Metasploit 2025-11-24ExploitCVE-2025-542361 file

exploit_multi/http/magento_sessionreaper · Ruby

MetasploitPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2025-54236 in Magento/Adobe Commerce to achieve unauthenticated remote code execution via a three-step chain: uploading a malicious PHP session file, triggering deserialization to redirect session storage, and executing the uploaded PHP code.

Backdoor review

No backdoor observed in reviewed code

The module is a standard Metasploit exploit for CVE-2025-54236. It uploads a crafted PHP session file, triggers deserialization, and executes a user-supplied payload. No concealed backdoor, unrelated remote access, persistence, or deceptive behavior was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareMagentoAdobe Commerce
Attack typesRemote Code ExecutionDeserializationUnrestricted File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's exploit method implements a complete attack chain that uploads a malicious file, triggers deserialization, and executes arbitrary code on the target, which is the definition of an exploit.

modules/exploits/multi/http/magento_sessionreaper.rb:127-162

Requirements

  • Target must be a Magento 2.x instance configured to use file-based session storage.modules/exploits/multi/http/magento_sessionreaper.rb:34-35
  • Target must be unpatched (patched versions return 400 Bad Request).modules/exploits/multi/http/magento_sessionreaper.rb:35-36

Observed behavior

  • Generates a Guzzle/FW1 deserialization payload containing a PHP stub that executes base64-decoded POST data.modules/exploits/multi/http/magento_sessionreaper.rb:134-136
  • Uploads the malicious session file via an unauthenticated POST to /customer/address_file/upload.modules/exploits/multi/http/magento_sessionreaper.rb:168-185
  • Triggers deserialization by sending a crafted JSON payload to /rest/default/V1/guest-carts/{cart_id}/order, which modifies the session savePath to point to the uploaded file.modules/exploits/multi/http/magento_sessionreaper.rb:219-232
  • Executes the uploaded PHP code by sending a POST request with the base64-encoded payload to the uploaded PHP file.modules/exploits/multi/http/magento_sessionreaper.rb:151-161
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Chain
Payload withheldThis is the documented exploit chain for CVE-2025-54236, consistent with the module description.modules/exploits/multi/http/magento_sessionreaper.rb:26-32
Payload Execution
Payload withheldThe module writes a PHP stub that evaluates a base64-decoded POST parameter, which is the standard Metasploit payload delivery mechanism.modules/exploits/multi/http/magento_sessionreaper.rb:135modules/exploits/multi/http/magento_sessionreaper.rb:154-161
File Cleanup
Payload withheldThe module registers artifacts for cleanup, which is normal Metasploit behavior and not indicative of persistence.modules/exploits/multi/http/magento_sessionreaper.rb:147-149
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The code was not executed; classification is based on static analysis of the source.
  • Only the module source and metadata were reviewed; framework mixins, libraries, and external payloads are not expanded.
  • Binary files were flagged as metadata-only and not analyzed, but no binary files were present in the evidence.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.