Active SessionReaper exploit hits Adobe Commerce and Magento

Ecommerce security firm Sansec warned on Thursday that threat actors have begun actively exploiting a recently disclosed critical vulnerability in Adobe Commerce and Magento Open Source, recording more than 250 attack attempts against multiple online stores over a 24 hour period. The flaw, tracked as CVE202554236 and nicknamed SessionReaper, carries a CVSS score of 9.1 and can be abused to take over customer accounts via the Commerce REST API and, under certain configurations, to achieve remote code execution.

Sansec said the attacks observed over the past day delivered PHP webshells or issued phpinfo probes to harvest PHP configuration details, and that the exploit attempts originated from multiple internet addresses. The company also reported that only 38 percent of Magento stores have applied Adobe’s fix, leaving 62 percent still vulnerable six weeks after the bug was publicly disclosed. Sansec urged administrators to apply the vendor patches immediately and to scan for signs of compromise. "PHP backdoors are uploaded via customeraddress_fileupload as a fake session," the company said in its advisory.

Adobe released a hotfix for the defect on September 9, after a partial...