Created
October 24, 2025 23:07
-
-
Save SamJUK/eb9b82d06c54415bb00341777cf50cad to your computer and use it in GitHub Desktop.
Mitigate SessionReaper (CVE-2025-54236) file upload exploit
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Disable SessionReaper (CVE-2025-54236) file upload exploit entirely. | |
| # note: make sure to check you do not use this functionality before applying. | |
| --- a/vendor/magento/module-customer/Controller/Address/File/Upload.php | |
| +++ b/vendor/magento/module-customer/Controller/Address/File/Upload.php | |
| @@ -70,6 +70,7 @@ | |
| */ | |
| public function execute() | |
| { | |
| + http_response_code(400);exit; | |
| try { | |
| $requestedFiles = $this->getRequest()->getFiles('custom_attributes'); | |
| if (empty($requestedFiles)) { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Mitigate SessionReaper (CVE-2025-54236) file upload exploit, by adding additional validation | |
| # to the file upload controller restricting file name,mime type and extension. | |
| # note: the following checks can be bypassed. | |
| --- a/vendor/magento/module-customer/Controller/Address/File/Upload.php | |
| +++ b/vendor/magento/module-customer/Controller/Address/File/Upload.php | |
| @@ -72,6 +72,18 @@ | |
| { | |
| try { | |
| $requestedFiles = $this->getRequest()->getFiles('custom_attributes'); | |
| + | |
| + foreach($requestedFiles as $key => $fileInfo) { | |
| + $isPotentialSessionFile = strpos($fileInfo['name'], 'sess_') === 0 || strpos($fileInfo['full_path'], 'sess_') === 0; | |
| + $isExpectedExtension = preg_match('/\.(jpg|jpeg|png|gif)$/i', $fileInfo['full_path']); | |
| + $mimeType = (new \finfo(FILEINFO_MIME_TYPE))->file($fileInfo['tmp_name']); | |
| + $isExpectedMimeType = in_array($mimeType, ['image/jpg', 'image/jpeg', 'image/png', 'image/gif']); | |
| + | |
| + if ($isPotentialSessionFile || !$isExpectedMimeType || !$isExpectedExtension) { | |
| + unset($requestedFiles[$key]); | |
| + } | |
| + } | |
| + | |
| if (empty($requestedFiles)) { | |
| $result = $this->processError(__('No files for upload.')); | |
| } else { |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment