Magento SessionReaper
PoC files
1 fileFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
A Metasploit module that exploits CVE-2025-54236 in Magento/Adobe Commerce to achieve unauthenticated remote code execution via a three-step chain: uploading a malicious PHP session file, triggering deserialization to redirect session storage, and executing the uploaded PHP code.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit exploit for CVE-2025-54236. It uploads a crafted PHP session file, triggers deserialization, and executes a user-supplied payload. No concealed backdoor, unrelated remote access, persistence, or deceptive behavior was observed.
Classification basis and observed behavior
Classification basis
The module's exploit method implements a complete attack chain that uploads a malicious file, triggers deserialization, and executes arbitrary code on the target, which is the definition of an exploit.
modules/exploits/multi/http/magento_sessionreaper.rb:127-162Requirements
- Target must be a Magento 2.x instance configured to use file-based session storage.
modules/exploits/multi/http/magento_sessionreaper.rb:34-35 - Target must be unpatched (patched versions return 400 Bad Request).
modules/exploits/multi/http/magento_sessionreaper.rb:35-36
Observed behavior
- Generates a Guzzle/FW1 deserialization payload containing a PHP stub that executes base64-decoded POST data.
modules/exploits/multi/http/magento_sessionreaper.rb:134-136 - Uploads the malicious session file via an unauthenticated POST to /customer/address_file/upload.
modules/exploits/multi/http/magento_sessionreaper.rb:168-185 - Triggers deserialization by sending a crafted JSON payload to /rest/default/V1/guest-carts/{cart_id}/order, which modifies the session savePath to point to the uploaded file.
modules/exploits/multi/http/magento_sessionreaper.rb:219-232 - Executes the uploaded PHP code by sending a POST request with the base64-encoded payload to the uploaded PHP file.
modules/exploits/multi/http/magento_sessionreaper.rb:151-161
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Upload PHP session file with Guzzle deserialization payload, trigger deserialization via REST API, execute uploaded PHP codeThis is the documented exploit chain for CVE-2025-54236, consistent with the module description.
modules/exploits/multi/http/magento_sessionreaper.rb:26-32 - Payload Execution
- Base64-encoded PHP eval of user-controlled POST parameterThe module writes a PHP stub that evaluates a base64-decoded POST parameter, which is the standard Metasploit payload delivery mechanism.
modules/exploits/multi/http/magento_sessionreaper.rb:135modules/exploits/multi/http/magento_sessionreaper.rb:154-161 - File Cleanup
- register_file_for_cleanup for uploaded PHP file and session fileThe module registers artifacts for cleanup, which is normal Metasploit behavior and not indicative of persistence.
modules/exploits/multi/http/magento_sessionreaper.rb:147-149
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The code was not executed; classification is based on static analysis of the source.
- Only the module source and metadata were reviewed; framework mixins, libraries, and external payloads are not expanded.
- Binary files were flagged as metadata-only and not analyzed, but no binary files were present in the evidence.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.