PHP Object Injection - Revision history

Egidio Romano at 18:50, 7 January 2015

2015-01-07T18:50:46Z

Egidio Romano at 19:23, 23 March 2014

2014-03-23T19:23:44Z

Egidio Romano at 14:23, 16 February 2014

2014-02-16T14:23:49Z

Egidio Romano: Undo revision 148404 by Egidio Romano (talk)

2013-03-22T03:49:02Z

Undo revision 148404 by Egidio Romano (talk)

Egidio Romano at 03:44, 22 March 2013

2013-03-22T03:44:55Z

Egidio Romano at 05:15, 22 January 2013

2013-01-22T05:15:15Z

Egidio Romano at 18:40, 10 December 2012

2012-12-10T18:40:59Z

Egidio Romano at 03:19, 6 December 2012

2012-12-06T03:19:39Z

Egidio Romano: Created page with "{{Template:Vulnerability}} Author(s): *Egidio Romano Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' [[ASDR_TOC_V..."

2012-12-04T23:48:34Z

Created page with "{{Template:Vulnerability}} Author(s): *Egidio Romano Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' [[ASDR_TOC_V..."

New page

{{Template:Vulnerability}}

Author(s):
*[[User:Egidio Romano|Egidio Romano]]

Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]

==Description==

PHP Object Injection is an application level vulnerability which allows an attacker to perform different kinds of malicious attacks.
The vulnerability occurs when user-supplied input is not properly sanitized before being used in call to the unserialize() PHP function. Since PHP allows objects serialization, attackers could pass ad-hoc serialized strings to the unserialize() function, resulting in an arbitrary PHP objects injection into the application scope.

In order to successfully exploit a PHP Object Injection vulnerability two conditions must be satisfied:

* The application must have a class which implements a PHP magic method (such as __wakeup or __destruct) that can be abused to conduct malicious attacks.
* That exploitable class must be declared when unserialize() is being called, otherwise object autoloading must be supported.

==Risk Factors==

* The impact of this vulnerability could be High but the likelihood is low. So, the severity of this type of vulnerability is Medium.
* This vulnerability can make the website vulnerable to some other types of attacks such as [[Path Traversal]], [[SQL Injection]] or [[Code Injection]].

==Examples==

The example below shows a PHP class with an exploitable __destruct method:
<pre>
<?php

class VulnCache
{
public $cache_file;
public $cache_data;

function __construct()
{
// some PHP code...
}

function __destruct()
{
file_put_contents($this->cache_file, $this->cache_data);
}
}

// some PHP code...

$user_data = unserialize($_GET['data']);

?>
</pre>
In this example an attacker might be able to create a new PHP file with arbitrary code, requesting the following URL:
<pre>http://site/vuln.php?data=O:9:"VulnCache":2:{s:10:"cache_file";s:8:"test.php";s:10:"cache_data";s:21:"<?php+evil_code();+?>";}</pre>

==Related [[Vulnerabilities]]==

* [[:Category:Input Validation Vulnerability]]

== Related [[Controls]] ==

* [[:Input Validation]]
* [[:Static Code Analysis]]

==Prevention==

Do not use unserialize() function with user-supplied input, use JSON functions instead.

==References==

* PHP: unserialize. http://php.net/manual/en/function.unserialize.php
* PHP: Magic Methods. http://php.net/manual/en/language.oop5.magic.php
* PHP: Autoloading Classes. http://php.net/manual/en/language.oop5.autoload.php
* Shocking news in PHP exploitation. http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf

[[Category:Injection]]

@@ Line 168: / Line 168: @@
 * [http://php.net/manual/en/language.oop5.autoload.php PHP: Autoloading Classes]
 * [https://wiki.php.net/rfc/secure_unserialize PHP RFC: Secured unserialize()]
-* [http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf Shocking News in PHP Exploitation] Stefan Esser, POC 2009
+* [https://www.owasp.org/images/f/f6/POC2009-ShockingNewsInPHPExploitation.pdf Shocking News in PHP Exploitation] Stefan Esser, POC 2009
-* [https://media.blackhat.com/bh-us-10/presentations/Esser/BlackHat-USA-2010-Esser-Utilizing-Code-Reuse-Or-Return-Oriented-Programming-In-PHP-Application-Exploits-slides.pdf Utilizing Code Reuse/ROP in PHP Application Exploits] Stefan Esser, BlackHat USA 2010
+* [https://www.owasp.org/images/9/9e/Utilizing-Code-Reuse-Or-Return-Oriented-Programming-In-PHP-Application-Exploits.pdf Utilizing Code Reuse/ROP in PHP Application Exploits] Stefan Esser, BlackHat USA 2010
 [[Category:Injection]]

@@ Line 10: / Line 10: @@
 ==Description==
-PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as [[Code Injection]], [[SQL Injection]], [[Path Traversal]] and [[Application Denial of Service]], depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers  could pass ad-hoc serialized strings to a vulnerable unserialize() function, resulting in an arbitrary PHP object(s) injection into the application scope.
+PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as [[Code Injection]], [[SQL Injection]], [[Path Traversal]] and [[Application Denial of Service]], depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers  could pass ad-hoc serialized strings to a vulnerable unserialize() call, resulting in an arbitrary PHP object(s) injection into the application scope.
 In order to successfully exploit a PHP Object Injection vulnerability two conditions must be met:
@@ Line 23: / Line 23: @@
 The example below shows a PHP class with an exploitable __destruct method:
 <pre>
 class Example1
+{
@@ Line 54: / Line 52: @@
 The example below shows a PHP class with an exploitable __wakeup method:
 <pre>
 class Example2
+{
@@ Line 86: / Line 82: @@
 Where the cookie parameter "data" has been generated by the following script:
 <pre>
 class Example2
+{
@@ Line 100: / Line 94: @@
 This last example shows how it is possible to perform a [[SQL Injection]] attack using a "POP chain", for instance by leveraging a __toString method like this:
 <pre>
 class Example3
+{
@@ Line 143: / Line 135: @@
 In this example an attacker might be able to perform a [[SQL Injection]] attack by sending a POST request containing a "data" parameter generated by a script like this:
 <pre>
 class SQL_Row_Value
+{
@@ Line 177: / Line 167: @@
 * [http://php.net/manual/en/language.oop5.magic.php PHP: Magic Methods]
 * [http://php.net/manual/en/language.oop5.autoload.php PHP: Autoloading Classes]
 * [http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf Shocking News in PHP Exploitation] Stefan Esser, POC 2009
 * [https://media.blackhat.com/bh-us-10/presentations/Esser/BlackHat-USA-2010-Esser-Utilizing-Code-Reuse-Or-Return-Oriented-Programming-In-PHP-Application-Exploits-slides.pdf Utilizing Code Reuse/ROP in PHP Application Exploits] Stefan Esser, BlackHat USA 2010

@@ Line 10: / Line 10: @@
 ==Description==
-PHP Object Injection is an application level vulnerability which allows an attacker to perform different kinds of malicious attacks, such as [[Code Injection]], [[SQL Injection]], [[Path Traversal]] and [[Application Denial of Service]]. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers  could pass ad-hoc serialized strings to a vulnerable unserialize() function resulting in an arbitrary PHP object(s) injection into the application scope.
+PHP Object Injection is an application level vulnerability that could allow an attacker to perform different kinds of malicious attacks, such as [[Code Injection]], [[SQL Injection]], [[Path Traversal]] and [[Application Denial of Service]], depending on the context. The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers  could pass ad-hoc serialized strings to a vulnerable unserialize() function, resulting in an arbitrary PHP object(s) injection into the application scope.
-In order to successfully exploit a PHP Object Injection vulnerability two conditions must be satisfied:
+In order to successfully exploit a PHP Object Injection vulnerability two conditions must be met:
-* The application must have a class which implements a PHP magic method (such as __wakeup or __destruct) that can be abused to  carry out malicious attacks.
+* The application must have a class which implements a PHP magic method (such as __wakeup or __destruct) that can be used to carry out malicious attacks, or to start a "POP chain".
-* This exploitable class must be declared when the vulnerable unserialize() is being called, otherwise object autoloading must be supported for that class.
+* All of the classes used during the attack must be declared when the vulnerable unserialize() is being called, otherwise object autoloading must be supported for such classes.
 ==Examples==
@@ Line 46: / Line 46: @@
 // some PHP code...
 </pre>
 In this example an attacker might be able to delete an arbitrary file via a [[Path Traversal]] attack, for e.g. requesting the following URL:
@@ Line 78: / Line 76: @@
 // some PHP code...
 </pre>
 In this example an attacker might be able to perform a [[Code Injection]] attack by sending an HTTP request like this:
@@ Line 87: / Line 83: @@
 Cookie: data=O%3A8%3A%22Example2%22%3A1%3A%7Bs%3A14%3A%22%00Example2%00hook%22%3Bs%3A10%3A%22phpinfo%28%29%3B%22%3B%7D
 Connection: close
 </pre>
@@ Line 100: / Line 174: @@
 ==References==
-* PHP: unserialize. http://php.net/manual/en/function.unserialize.php
+* [http://php.net/manual/en/function.unserialize.php PHP: unserialize]
-* PHP: Magic Methods. http://php.net/manual/en/language.oop5.magic.php
+* [http://php.net/manual/en/language.oop5.magic.php PHP: Magic Methods]
-* PHP: Autoloading Classes. http://php.net/manual/en/language.oop5.autoload.php
+* [http://php.net/manual/en/language.oop5.autoload.php PHP: Autoloading Classes]
-* Shocking news in PHP exploitation. http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf
+* [http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf Shocking News in PHP Exploitation] Stefan Esser, POC 2009
 [[Category:Injection]]

@@ Line 14: / Line 14: @@
 In order to successfully exploit a PHP Object Injection vulnerability two conditions must be satisfied:
-* The application must have a class which implements a PHP magic method (such as __wakeup or __destruct) that can be abused to carry out malicious attacks.
+* The application must have a class which implements a PHP magic method (such as __wakeup or __destruct) that can be abused to  carry out malicious attacks.
-* This exploitable class must be declared when the vulnerable unserialize() is being called, otherwise "object autoloading" must be supported for that class.
+* This exploitable class must be declared when the vulnerable unserialize() is being called, otherwise object autoloading must be supported for that class.
 ==Examples==
@@ Line 88: / Line 88: @@
 Connection: close
 </pre>
 == Related [[Controls]]  ==

@@ Line 11: / Line 11: @@
 PHP Object Injection is an application level vulnerability which allows an attacker to perform different kinds of malicious attacks.
-The vulnerability occurs when user-supplied input is not properly sanitized before being used in call to the unserialize() PHP function. Since PHP allows object serialization, attackers  could pass ad-hoc serialized strings to a vulnerable unserialize() function resulting in an arbitrary PHP object(s) injection into the application scope.
+The vulnerability occurs when user-supplied input is not properly sanitized before being passed to the unserialize() PHP function. Since PHP allows object serialization, attackers  could pass ad-hoc serialized strings to a vulnerable unserialize() function resulting in an arbitrary PHP object(s) injection into the application scope.
 In order to successfully exploit a PHP Object Injection vulnerability two conditions must be satisfied:
@@ Line 54: / Line 54: @@
 ?>
 </pre>
 In this example an attacker might be able to delete an arbitrary file via a [[Path Traversal]] attack, for e.g. requesting the following URL:
@@ Line 88: / Line 87: @@
 ?>
 </pre>
 In this example an attacker might be able to perform a [[Code Injection]] attack by sending an HTTP request like this:
 <pre>
 GET /vuln.php HTTP/1.0

@@ Line 21: / Line 21: @@
 * The impact of this vulnerability could be High but the likelihood is low. So, the severity of this type of vulnerability is Medium.
-* This vulnerability can make the website vulnerable to some other types of attacks such as [[Path Traversal]], [[SQL Injection]] or [[Code Injection]].
+* This vulnerability can make the application vulnerable to some kinds of attacks such as [[Path Traversal]], [[SQL Injection]] or [[Code Injection]].
 ==Examples==
 The example below shows a PHP class with an exploitable __destruct method:
@@ Line 29: / Line 31: @@
 <?php
-class VulnCache
+class Example1
+{
     public $cache_file;
     function __construct()
@@ Line 41: / Line 42: @@
     function __destruct()
+    {
-       file_put_contents($this->cache_file, $this->cache_data);
+       $file = "/var/www/cache/tmp/{$this->cache_file}";
+    }
+}
@@ Line 52: / Line 54: @@
 ?>
 </pre>
 ==Related [[Vulnerabilities]]==

@@ Line 11: / Line 11: @@
 PHP Object Injection is an application level vulnerability which allows an attacker to perform different kinds of malicious attacks.
-The vulnerability occurs when user-supplied input is not properly sanitized before being used in call to the unserialize() PHP function. Since PHP allows objects serialization, attackers  could pass ad-hoc serialized strings to the unserialize() function, resulting in an arbitrary PHP objects injection into the application scope.
+The vulnerability occurs when user-supplied input is not properly sanitized before being used in call to the unserialize() PHP function. Since PHP allows object serialization, attackers  could pass ad-hoc serialized strings to a vulnerable unserialize() function resulting in an arbitrary PHP object(s) injection into the application scope.
 In order to successfully exploit a PHP Object Injection vulnerability two conditions must be satisfied:
 * The application must have a class which implements a PHP magic method (such as __wakeup or __destruct) that can be abused to conduct malicious attacks.
-* That exploitable class must be declared when unserialize() is being called, otherwise object autoloading must be supported.
+* That exploitable class must be declared when the vulnerable unserialize() is being called, otherwise object autoloading must be supported for that class.
 ==Risk Factors==
@@ Line 48: / Line 48: @@
 $user_data = unserialize($_GET['data']);
 ?>