Multiple independent intrusion campaigns targeting Magento e-commerce environments have resulted in the complete compromise of more than 200 websites worldwide.
These attacks leverage a critical vulnerability tracked as CVE-2025-54236, also known as “SessionReaper.”
The flaw allows threat actors to bypass authentication mechanisms by replaying improperly invalidated session tokens, leading to unauthorized account access and, in severe cases, root-level system takeover.
The firm that identified these intrusions observed distinct threat actors utilizing different infrastructures to exploit the vulnerability.
While one campaign focused on mass-scanning and retrieving sensitive system files, another focused on establishing persistent access via web shells.
The simultaneous abuse of this flaw by unconnected groups highlights the urgent risk posed to unpatched Magento instances.
Mass Exploitation and Root Compromise
The most aggressive campaign identified in this wave originated from a command-and-control (C2) infrastructure based in Finland.
This adversary launched a large-scale scan to identify vulnerable Magento Commerce APIs.
By exploiting the SessionReaper vulnerability, the attackers successfully mapped out a significant attack surface, identifying over 1,460 vulnerable APIs.
These targets were cataloged in a file named success_api_2025.txt on the attacker’s server, indicating a highly automated and structured approach to target selection.
The impact of this campaign was severe. Analysis confirmed that at least 216 of the identified sites were fully compromised.
The attackers did not stop at simple application-level access; they escalated privileges to gain root access on the host servers.
Evidence of this deep compromise was found in the exfiltration of /etc/passwd files from the victim systems.
The recovery of these files demonstrates that the attackers had unrestricted read access to the underlying operating system.
According to Oasis Security, each leaked file corresponded to a distinct compromised system, confirming that the threat actors had bypassed all application security layers.
With root access, these adversaries could potentially steal customer payment data, modify site code, or pivot to other connected systems within the network.
A second, distinct campaign was observed targeting Magento environments specifically in Canada and Japan.
This operation utilized C2 infrastructure located in Hong Kong and focused on establishing persistence rather than immediate data exfiltration.
The threat actors exploited CVE-2025-54236 to upload web shells to the victim servers, granting them long-term remote control over the compromised sites.
Logs recovered from the adversary’s infrastructure revealed successful uploads of malicious scripts to attacker-controlled paths.
These logs were meticulously structured, listing the victim URLs alongside the specific paths where the web shells were deployed and the associated control keys required to access them.
File names such as 404_key.txt and key.txt were used to store these credentials.
The deployment of web shells transforms a temporary vulnerability exploitation into a persistent security incident.
Even if the original vulnerability is patched, the web shells allow the attackers to maintain access, execute arbitrary commands, and modify files at will.
This campaign highlights the danger that “SessionReaper” facilitates the initial foothold required for complex, long-duration attacks.
| Feature | Detail |
|---|---|
| CVE ID | CVE-2025-54236 |
| Alias | SessionReaper |
| Vulnerability Type | Authentication Bypass / Session Replay |
| Affected Software | Magento Commerce |
| Attack Vector | Improper Session Invalidation |
| Impact | Account Takeover, RCE, Root Compromise |
| Severity | Critical |
The core of CVE-2025-54236 lies in how the Magento platform handles session termination. Under specific conditions, session tokens are not invalidated adequately after use or logout.
This failure allows attackers to capture valid tokens and replay them against the server.
Because the server recognizes the token as still active, it grants the attacker access to the associated user’s session without requiring a password.
When exploited against administrator accounts or API endpoints, this allows for total system control.
Administrators managing Magento environments are advised to apply the latest security patches immediately to mitigate CVE-2025-54236.
Furthermore, given the prevalence of web shell deployment, a thorough audit of the webroot for unrecognized files and a review of access logs for suspicious IP addresses is recommended to ensure no persistent backdoors remain.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
