SessionReaper Flaw Enables Seamless Session Hijacking on Adobe Commerce

Red | Vulnerability Report

CVE-2025-54236: SessionReaper Flaw Enables Seamless Session Hijacking on Adobe Commerce

Summary

The SessionReaper (CVE-2025-54236) vulnerability poses a critical security threat to both Adobe Commerce (including B2B) and Magento Open Source platforms. First discovered in September 2025, this improper input validation flaw allows unauthenticated attackers to hijack customer sessions and, under certain configurations, achieve remote code execution (RCE) through the Commerce REST API.

Despite Adobe’s emergency patch, 62% of Magento stores remain unpatched, and over 250 active attack attempts were recorded in just the last 24 hours. The exploit employs malicious session injection and nested deserialization, following a pattern similar to the previous CosmicSting incident. Security researchers warn of mass exploitation within 48 hours if unpatched systems persist.

Vulnerability Details

Attack Vector and Exploitation Path

The SessionReaper vulnerability allows attackers to seize control of user sessions without authentication via the Magento REST API. This zero-interaction attack grants full session hijacking and potential remote code execution under certain conditions, particularly when file-based session storage is used.

Affected Versions

Adobe Commerce: Versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier
Adobe Commerce B2B: Versions 1.5.3-alpha2, 1.5.2-p2, 1.4.2-p7, 1.3.4-p14, 1.3.3-p15 and earlier
Magento Open Source: Versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14 and earlier
CWE ID: CWE-20 (Improper Input Validation)
CPEs:
- cpe:2.3:a:adobe:commerce:-:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:commerce_b2b:-:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:magento:-:*:*:open_source:*:*:*

Observed Exploitation

Attackers are leveraging publicly available exploit code, targeting unpatched systems through malicious session injections. These attacks are increasing rapidly, with exploitation campaigns now spreading globally across retail and e-commerce sectors.

Recommendations

Immediate Patch Deployment:
Apply Adobe’s emergency patch for CVE-2025-54236 across all instances of Adobe Commerce and Magento Open Source immediately. Verify updates across all extensions and dependencies.
Patch Link: Adobe APSB25-88
Limit Public Exposure:
- Restrict REST API access using IP whitelisting.
- Enforce strong authentication and rate limiting.
- Apply least privilege access to all API and admin accounts.
Harden Perimeter Defenses:
Update Web Application Firewall (WAF) rules with SessionReaper-specific signatures and enable Intrusion Detection Systems (IDS) to detect session injection or deserialization patterns.
Continuous Monitoring:
Monitor for anomalous session activity, unexpected API calls, and unauthorized configuration changes across Commerce instances.

Indicators of Compromise (IoCs)

Type	Value
IPv4	34[.]227[.]25[.]4, 44[.]212[.]43[.]34, 54[.]205[.]171[.]35, 155[.]117[.]84[.]134, 159[.]89[.]12[.]166

MITRE ATT&CK TTPs

Tactic	Technique ID	Description
Initial Access	TA0001	Exploit Public-Facing Application (T1190)
Execution	TA0002	Command and Scripting Interpreter (T1059)
Persistence	TA0003	Exploitation of Remote Services (T1210)
Defense Evasion	TA0005	Obfuscated Files or Information (T1027), Exploitation for Defense Evasion (T1211)
Credential Access	–	Steal Web Session Cookie (T1539)
Command and Control	–	Web Protocols (T1071.001)

References

What’s new on HivePro

Get through updates and upcoming events, and more directly in your inbox