VC-12464 : Add coverage for CISA KEV CVE: CVE-2026-45247-Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability

[apatole-r7]

Description

VC-12464
Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

Reference links : https://nvd.nist.gov/vuln/detail/CVE-2026-45247
https://mirasvit.com/package/changelog/?package=mirasvit/module-cache-warmer

Related PR : https://github.com/rapid7/nexpose-content/pull/27796

How Has This Been Tested?

1. Windows
   vulnerable version (1.11.11)

2026-06-24T12:34:36 [INFO] [Thread: convert-open-tcp-ports-to-services@10.4.30.149] [Site: a_test_windows] [10.4.30.149:80/tcp] Service running: ServiceFingerprint [[certainty=0.9][description=Mirasvit Cache Warmer 1.11.11][family=null][product=Cache Warmer][protocol=HTTP][vendor=Mirasvit][version=1.11.11]]
2026-06-24T12:34:36 [DEBUG] [Thread: convert-open-tcp-ports-to-services@10.4.30.149] [Site: a_test_windows] [10.4.30.149:80/tcp] Asserting ServiceConfiguration: {http.banner=Mirasvit-Cache-Warmer/1.11.11, http.banner.server=Mirasvit-Cache-Warmer/1.11.11}

2026-06-24T12:34:56 [DEBUG] [Thread: http-sun-web-console-fp-thread@10.4.30.149:80] [Site: a_test_windows] [Status: Complete] [Duration: 0:00:00.003]
2026-06-24T12:34:56 [INFO] [Thread: VulnerabilityCheckContext.performTests-1@10.4.30.149:80] [Site: a_test_windows] [10.4.30.149:80] [Duration: 00:00:00.000] mirasvit-cachewarmer-cve-2026-45247 (mirasvit-cachewarmer-cve-2026-45247) - VULNERABLE VERSION
2026-06-24T12:34:56 [DEBUG] [Thread: VulnerabilityCheckContext.performTests-1@10.4.30.149:80] [Site: a_test_windows] [Status: Complete] [Duration: 0:00:00.000]

not vulnerable version (1.11.12)

2026-06-24T12:51:32 [INFO] [Thread: convert-open-tcp-ports-to-services@10.4.30.149] [Site: a_test_windows] [10.4.30.149:80/tcp] Service running: ServiceFingerprint [[certainty=0.9][description=Mirasvit Cache Warmer 1.11.12][family=null][product=Cache Warmer][protocol=HTTP][vendor=Mirasvit][version=1.11.12]]

2026-06-24T12:51:52 [DEBUG] [Thread: VulnerabilityCheckContext.performTests-1@10.4.30.149:80] [Site: a_test_windows] Scan: [10.4.30.149:80] [Duration: 00:00:00.000] mirasvit-cachewarmer-cve-2026-45247 (mirasvit-cachewarmer-cve-2026-45247) - NOT VULNERABLE VERSION(U)
2026-06-24T12:51:52 [DEBUG] [Thread: VulnerabilityCheckContext.performTests-1@10.4.30.149:80] [Site: a_test_windows] [Status: Complete] [Duration: 0:00:00.000]

2. Linux
   vulnerable version (1.11.11)

2026-06-24T11:44:27 [INFO] [Thread: 10.4.93.146:80/TCP] [Site: a_test_vc-12464] Creating ServiceFingerprint [[certainty=0.9][description=Mirasvit Cache Warmer 1.11.11][family=null][product=Cache Warmer][protocol=HTTP][vendor=Mirasvit][version=1.11.11]]
2026-06-24T11:44:27 [INFO] [Thread: 10.4.93.146:80/TCP] [Site: a_test_vc-12464] Checking for SERVER match to: Mirasvit-Cache-Warmer/1.11.11
2026-06-24T11:44:27 [INFO] [Thread: 10.4.93.146:80/TCP] [Site: a_test_vc-12464] [http_header.server] Matching against banner: Mirasvit-Cache-Warmer/1.11.11

2026-06-24T11:45:37 [INFO] [Thread: VulnerabilityCheckContext.performTests-1@10.4.93.146:80] [Site: a_test_vc-12464] [10.4.93.146:80] [Duration: 00:00:00.003] mirasvit-cachewarmer-cve-2026-45247 (mirasvit-cachewarmer-cve-2026-45247) - VULNERABLE VERSION
2026-06-24T11:45:37 [DEBUG] [Thread: VulnerabilityCheckContext.performTests-1@10.4.93.146:80] [Site: a_test_vc-12464] [Status: Complete] [Duration: 0:00:00.011]

not vulnerable version (1.11.12)

2026-06-24T13:00:29 [INFO] [Thread: 10.4.93.146:80/TCP] [Site: a_test_vc-12464] Creating ServiceFingerprint [[certainty=0.9][description=Mirasvit Cache Warmer 1.11.12][family=null][product=Cache Warmer][protocol=HTTP][vendor=Mirasvit][version=1.11.12]]
2026-06-24T13:00:29 [INFO] [Thread: 10.4.93.146:80/TCP] [Site: a_test_vc-12464] Checking for SERVER match to: Mirasvit-Cache-Warmer/1.11.12
2026-06-24T13:00:29 [INFO] [Thread: 10.4.93.146:80/TCP] [Site: a_test_vc-12464] [http_header.server] Matching against banner: Mirasvit-Cache-Warmer/1.11.12

2026-06-24T13:01:37 [DEBUG] [Thread: unix-find-user-dir-mode-thread@10.4.93.146:22] [Site: a_test_vc-12464] [Status: Complete] [Duration: 0:00:00.007]
2026-06-24T13:01:37 [DEBUG] [Thread: VulnerabilityCheckContext.performTests-1@10.4.93.146:80] [Site: a_test_vc-12464] Scan: [10.4.93.146:80] [Duration: 00:00:00.000] mirasvit-cachewarmer-cve-2026-45247 (mirasvit-cachewarmer-cve-2026-45247) - NOT VULNERABLE VERSION(U)
2026-06-24T13:01:37 [DEBUG] [Thread: VulnerabilityCheckContext.performTests-1@10.4.93.146:80] [Site: a_test_vc-12464] [Status: Complete] [Duration: 0:00:00.001]

DTest passed

     [java] [INFO] ------------------------------------------------------------------------
     [java] [INFO] Reactor Summary for nexpose-root 1.0.0-DONTCHANGEME-SNAPSHOT:
     [java] [INFO] 
     [java] [INFO] nexpose-root ....................................... SUCCESS [  0.564 s]
     [java] [INFO] nexpose ............................................ SUCCESS [  0.032 s]
     [java] [INFO] nexshared .......................................... SUCCESS [40:00 min]
     [java] [INFO] plugin ............................................. SUCCESS [ 57.815 s]
     [java] [INFO] nse ................................................ SUCCESS [  9.424 s]
     [java] [INFO] nsc ................................................ SUCCESS [ 57.228 s]
     [java] [INFO] installer .......................................... SUCCESS [  0.338 s]
     [java] [INFO] tools .............................................. SUCCESS [03:13 min]
     [java] [INFO] ------------------------------------------------------------------------
     [java] [INFO] BUILD SUCCESS
     [java] [INFO] ------------------------------------------------------------------------
     [java] [INFO] Total time:  45:20 min
     [java] [INFO] Finished at: 2026-06-25T09:50:27+05:30
     [java] [INFO] ------------------------------------------------------------------------

BUILD SUCCESSFUL
Total time: 61 minutes 8 seconds
apatole@PNQ-MBP-14600 src %  

Types of changes

xml/http_servers.xml -> mirasvit fingerprint

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• I have updated the documentation accordingly (or changes are not required).
• I have added tests to cover my changes (or new tests are not required).
• All new and existing tests passed.