PHP Object Injection | Web Security

🧠 Description

What is the vulnerability?

PHP Object Injection occurs when user‑supplied input is passed to unserialize() without proper validation. An attacker can supply a crafted serialized string that, when unserialized, instantiates arbitrary PHP objects and may trigger magic methods (e.g., __wakeup(), __destruct()) leading to Remote Code Execution (RCE), file deletion, or privilege escalation.

Why does it occur?

Developers use unserialize() on data from cookies, session storage, or API inputs, trusting it without sanitisation.

Security principle violated: Insecure Deserialization

Real-world analogy: Accepting a pre‑packaged box from a stranger and opening it – you have no control over what's inside.

🏷️ Classification

Type: Insecure Deserialization
OWASP: A08:2021 – Software and Data Integrity Failures
CWE: CWE-502: Deserialization of Untrusted Data

🎯 Attack Surface

✅ PHP sessions (serialized data in cookies or files)
✅ API endpoints accepting serialized objects (e.g., application/x-php-serialized)
✅ Parameters passed to unserialize() from user input
✅ Applications using __wakeup() or __destruct() for file operations

🔍 Detection Methodology

Look for parameters that look like serialized PHP data: O:4:"User":1:{s:4:"name";s:3:"abc";}
Use static analysis to find unserialize($_GET[...]) or unserialize($_COOKIE[...])
Fuzz with a harmless serialized object and observe behaviour changes.

💣 Basic Payloads

# Simple serialized string for a class with a destructor
O:1:"A":0:{}

🚀 Advanced Exploitation (POP Chain)

# Example payload using a known gadget chain (PHPGGC)
phpggc Monolog/RCE1 system 'id' -s
# Then send the generated payload to the vulnerable unserialize() endpoint.

🧪 Test Cases (STRICT)

Step	Action	Expected	Actual
1	Submit a malformed serialized string (e.g., `O:1:"A":0:{}`)	Error or no effect	Application crash or unexpected behaviour
2	Use PHPGGC to generate a payload for RCE	No output or blocked	Command executed (e.g., `id` output)

⚙️ Exploitation Steps

Identify input that is passed to unserialize().
Enumerate classes and available magic methods (use code review or PHPGGC).
Craft a gadget chain to achieve RCE.
Deliver the payload and execute commands.

🛡️ Mitigation

✅ Never use unserialize() on user input.
✅ Use safe alternatives like json_decode().
✅ Implement allowlist of classes when deserializing (e.g., unserialize($data, ['allowed_classes' => ['MyClass']])).
✅ Use signature verification (HMAC) for serialized data.
✅ Keep dependencies updated to avoid known gadget chains.

🔓 Mitigation Bypass

If allowlist is too broad, attackers may still find usable classes.
If custom autoloaders are misconfigured, new classes can be injected.

⚠️ Risk / Impact

Severity: Critical

Impact: Remote Code Execution, complete server takeover, data breach.

📎 Proof of Concept (PoC)

# Vulnerable code
$data = $_GET['data'];
$obj = unserialize($data);

# Payload
?data=O:8:"stdClass":0:{}

📚 References

Back to Web Security

📌 PHP Object Injection (Insecure Deserialization)