Mirasvit Full Page Cache Warmer for Magento 2 Unauthenticated PHP Object Injection to RCE

#!/usr/bin/env bash
# check_cve_2026_45247.sh — CVE-2026-45247 Mirasvit Cache Warmer detection
# Usage: bash check_cve_2026_45247.sh <MAGENTO_STORE_URL>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:?Usage: $0 <MAGENTO_STORE_URL>}"
TARGET="${TARGET%/}"

# Strip trailing slash and ensure https
if [[ ! "$TARGET" =~ ^https?:// ]]; then
  TARGET="https://$TARGET"
fi

echo "[*] Checking CVE-2026-45247 against: $TARGET"

# Step 1: Send a benign canary value in the CacheWarmer cookie.
# A vulnerable version will attempt to unserialize the value.
# We use a deliberately malformed serialized string that will
# cause a PHP notice/warning but NOT execute code.
# The canary is: s:13:"NOISGATE_TEST"; (a valid serialized PHP string, harmless)
CANARY=$(echo -n 's:13:"NOISGATE_TEST";' | base64 | tr -d '\n')

RESPONSE=$(curl -sS -o /dev/null -w "%{http_code}" \
  --max-time 10 \
  -H "Cookie: CacheWarmer=CacheWarmer:${CANARY}" \
  "$TARGET/" 2>&1) || true

if [[ -z "$RESPONSE" ]]; then
  echo "[!] UNKNOWN — Could not connect to $TARGET"
  exit 2
fi

# Step 2: Check if the Mirasvit Cache Warmer extension is present
# by looking for characteristic response headers or module indicators
HEADERS=$(curl -sS -D - -o /dev/null --max-time 10 "$TARGET/" 2>/dev/null) || true

# Step 3: Try to detect extension via Composer lock if publicly accessible
# (some misconfigured stores expose this)
COMPOSER_CHECK=$(curl -sS --max-time 10 "$TARGET/composer.lock" 2>/dev/null) || true

if echo "$COMPOSER_CHECK" | grep -q 'mirasvit/module-cache-warmer'; then
  # Extract version
  VERSION=$(echo "$COMPOSER_CHECK" | grep -A5 'mirasvit/module-cache-warmer' | grep -oP '"version"\s*:\s*"\K[^"]+' | head -1)
  if [[ -n "$VERSION" ]]; then
    echo "[*] Detected mirasvit/module-cache-warmer version: $VERSION"
    # Compare versions
    FIXED="1.11.12"
    if printf '%s\n' "$FIXED" "$VERSION" | sort -V | head -1 | grep -q "$FIXED"; then
      # VERSION >= FIXED
      echo "[+] PATCHED — Version $VERSION >= $FIXED"
      exit 0
    else
      echo "[!] VULNERABLE — Version $VERSION < $FIXED"
      exit 1
    fi
  fi
fi

# Step 4: If composer.lock not accessible, check via module_status
# Try the setup check endpoint (Magento CLI output if accessible)
MODULE_CHECK=$(curl -sS --max-time 10 "$TARGET/mirasvit_cache_warmer/" 2>/dev/null) || true

# Step 5: Heuristic — check if the CacheWarmer cookie is processed
# Send request WITHOUT the cookie, then WITH it, compare behavior
RESP_NOCOOKIE=$(curl -sS -o /dev/null -w "%{http_code}:%{size_download}" \
  --max-time 10 "$TARGET/" 2>/dev/null) || true

RESP_WITHCOOKIE=$(curl -sS -o /dev/null -w "%{http_code}:%{size_download}" \
  --max-time 10 \
  -H "Cookie: CacheWarmer=CacheWarmer:dGVzdA==" \
  "$TARGET/" 2>/dev/null) || true

# If we got a 500 error with the cookie but 200 without, strong indicator
NOCOOKIE_CODE=$(echo "$RESP_NOCOOKIE" | cut -d: -f1)
WITHCOOKIE_CODE=$(echo "$RESP_WITHCOOKIE" | cut -d: -f1)

if [[ "$WITHCOOKIE_CODE" == "500" && "$NOCOOKIE_CODE" == "200" ]]; then
  echo "[!] VULNERABLE — Server returns 500 when processing CacheWarmer cookie"
  echo "    (unserialize() likely threw a fatal error on malformed input)"
  exit 1
fi

if [[ "$NOCOOKIE_CODE" == "200" && "$WITHCOOKIE_CODE" == "200" ]]; then
  echo "[?] UNKNOWN — Store is reachable but cannot conclusively determine"
  echo "    Cache Warmer presence or version remotely."
  echo "    ACTION: SSH into the server and run:"
  echo "    composer show mirasvit/module-cache-warmer 2>/dev/null | grep -i version"
  echo "    If installed and version < 1.11.12, the store is VULNERABLE."
  exit 2
fi

echo "[?] UNKNOWN — Inconclusive (HTTP $NOCOOKIE_CODE without cookie, $WITHCOOKIE_CODE with cookie)"
echo "    Manual verification required. SSH in and run:"
echo "    composer show mirasvit/module-cache-warmer 2>/dev/null | grep -i version"
exit 2