Insecure Deserialization

What it is#

Insecure deserialization happens when an application reconstructs a PHP object from attacker-controlled serialized data, and a class reachable in that process has a magic method, such as __wakeup, __destruct or __toString, that does something dangerous when triggered: a property-oriented programming (POP) gadget chain.

How it works#

$preferences = unserialize($_COOKIE['prefs']);

An attacker who controls the cookie's serialized bytes controls which classes get instantiated and what their properties are set to. If any class already loaded by the app has a __destruct() that writes a file using an attacker-controlled property, that is the whole chain: no new code-execution primitive is added, an existing one is triggered with attacker-chosen inputs.

Real-world impact#

Ranges from arbitrary file write or delete to full remote code execution, depending on which gadget is reachable in the classes the app already loads.

How to prevent it#

$preferences = json_decode($_COOKIE['prefs'], true); // never unserialize()

Never call unserialize() on anything attacker-controlled; use a data-only format such as JSON instead. If PHP's native serialization format must be kept, restrict allowed classes explicitly with unserialize($data, ['allowed_classes' => []]).