CVE-2025-54236
📋 TL;DR
CVE-2025-54236 is an improper input validation vulnerability in Adobe Commerce (Magento) that allows unauthenticated attackers to achieve session takeover. This enables attackers to hijack user sessions and potentially gain administrative access without user interaction. All Adobe Commerce versions 2.4.9-alpha2 and earlier are affected.
💻 Affected Systems
- Adobe Commerce
- Magento Open Source
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Adobe Commerce instance allowing attackers to take over administrative sessions, access sensitive customer data, modify orders, and potentially achieve remote code execution.
Likely Case
Session hijacking leading to unauthorized access to user accounts, theft of personal information, and potential privilege escalation to administrative functions.
If Mitigated
Limited impact with proper session management and monitoring, but still presents authentication bypass risk.
🎯 Exploit Status
Exploit code is publicly available and has been confirmed to work without authentication. CISA has added this to their Known Exploited Vulnerabilities catalog.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Adobe Commerce 2.4.9-beta1, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, or 2.4.4-p16
Vendor Advisory: https://helpx.adobe.com/security/products/magento/apsb25-88.html
Restart Required: Yes
Instructions:
1. Backup your Adobe Commerce instance. 2. Apply the security patch via Composer: composer require magento/security-package. 3. Clear cache: php bin/magento cache:clean. 4. Restart web server services.
🔧 Temporary Workarounds
Session Validation Enhancement
allImplement additional session validation checks to detect and block session hijacking attempts
Implement custom session validation middleware that checks for abnormal session parameters
Rate Limiting
allApply rate limiting to session-related endpoints to slow down automated exploitation
Configure web server or WAF to limit requests to /customer/account/loginPost and similar endpoints
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block known exploit patterns for session takeover attacks
- Enable enhanced logging and monitoring for session anomalies and implement immediate alerting for suspicious session activities
🔍 How to Verify
Check if Vulnerable:
Check Adobe Commerce version via admin panel or run: php bin/magento --versionCheck Version:
php bin/magento --versionVerify Fix Applied:
Verify version is updated to patched version and test session functionality remains intact📡 Detection & Monitoring
Log Indicators:
- Unusual session creation patterns
- Multiple session IDs from same IP
- Session parameter manipulation in logs
Network Indicators:
- Abnormal requests to session management endpoints
- Spike in 302 redirects or authentication-related traffic
SIEM Query:
source="*access.log*" (url="/customer/account/loginPost" OR url="/admin") | stats count by src_ip, session_id🔗 References
- https://helpx.adobe.com/security/products/magento/apsb25-88.html
- https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397
- https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236
