CVE-2026-45247: Mirasvit Full Page Cache Warmer Exploitation — Detection and Remediation

---
title: Potential Exploitation of Mirasvit Cache Warmer Deserialization
id: 9c8e7f12-a345-4b8a-9c1d-2e3f4a5b6c7d
status: experimental
description: Detects suspicious HTTP POST requests to Mirasvit Full Page Cache Warmer endpoints, which may indicate attempts to exploit CVE-2026-45247 via deserialization payloads.
references:
  - https://www.cisa.gov/news-events/alerts/2026/06/03/cisa-adds-one-known-exploited-vulnerability-catalog
author: Security Arsenal
date: 2026/06/04
tags:
  - attack.initial_access
  - attack.web_shell
  - attack.t1190
logsource:
  category: webserver
  product: apache
  # or nginx/iis depending on env
detection:
  selection:
    c|contains: 'POST'
    cs-uri-stem|contains:
      - '/warmer/index/index'
      - '/cache_warmer/proxy/index'
  selection_content:
    cs-bytes|gt: 500 # Deserialization payloads (PHP objects) are often larger than standard cache requests
  condition: selection and selection_content
falsepositives:
  - Legitimate heavy cache warming requests (unlikely to be POST)
level: high
---
title: Web Server Process Spawning Shell (Potential Webshell)
id: b1d2e3f4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects the web server user spawning a shell process, a common indicator of successful RCE via CVE-2026-45247.
author: Security Arsenal
date: 2026/06/04
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/httpd'
      - '/nginx'
      - '/apache2'
      - '/php-fpm'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/perl'
      - '/python'
      - '/nc'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripts executed by cron
level: critical

// Hunt for anomalous POST requests to Cache Warmer endpoints
Syslog  
| where ProcessName contains "nginx" or ProcessName contains "httpd" or ProcessName contains "apache"
| parse SyslogMessage with * "Method: " Method ", RequestURI: " RequestURI * 
| where Method == "POST" and (RequestURI contains "/warmer/" or RequestURI contains "/cache_warmer/")
| extend PayloadSize = toint(substring(SyslogMessage, indexof(SyslogMessage, "Content-Length:"), 50))
| where isnotempty(PayloadSize) and PayloadSize > 1000
| project TimeGenerated, ComputerName, SourceIP, RequestURI, PayloadSize, SyslogMessage
| order by TimeGenerated desc

-- Hunt for recent PHP file modifications in the Mirasvit module directory
-- and potential webshell artifacts in the cache warmer path
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs='/*/*/app/code/Mirasvit/CacheWarmer/**/*.php')
WHERE Mtime > timestamp("2026-06-01") 
  OR Size < 200 // Detect small suspicious PHP files often used as webshells

-- Hunt for webserver processes spawning shells
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name IN ('bash', 'sh', 'perl', 'python')
  AND Ppid IN (
    SELECT Pid 
    FROM pslist() 
    WHERE Name IN ('httpd', 'nginx', 'apache2', 'php-fpm')
  )

#!/bin/bash
# Remediation Audit Script for CVE-2026-45247
# Checks for Mirasvit module presence and known bad file hashes/locations

echo "[+] Checking for Mirasvit Full Page Cache Warmer installation..."

# Common Magento paths
MAGENTO_ROOT="/var/www/html"
MODULE_PATH="app/code/Mirasvit/CacheWarmer"

if [ -d "$MAGENTO_ROOT/$MODULE_PATH" ]; then
    echo "[!] Module found at $MAGENTO_ROOT/$MODULE_PATH"
    
    echo "[+] Checking for recent modifications (Last 7 days)..."
    find "$MAGENTO_ROOT/$MODULE_PATH" -name "*.php" -mtime -7 -ls
    
    echo "[!] ACTION REQUIRED: Review the composer. and update the Mirasvit module immediately."
    echo "    Apply the patch referenced in the vendor advisory for CVE-2026-45247."
else
    echo "[-] Module not found in default path."
fi

echo "[+] Scanning for suspicious .php files in var/cache or pub/media (Webshell staging)..."
find "$MAGENTO_ROOT/pub/media" -name "*.php" -ls
find "$MAGENTO_ROOT/var/cache" -name "*.php" -ls

echo "[+] Audit complete."