Insecure Deserialization

Also Known As

TL;DR

Explanation

PHP's unserialize() reconstructs objects from a serialised string, invoking magic methods like __wakeup() and __destruct() in the process. Attackers can craft serialised payloads that exploit available classes (known as "gadget chains") to achieve arbitrary code execution, file deletion, or privilege escalation — without needing a file upload. The safe alternative is json_decode() for data exchange; if serialisation is required, restrict allowed_classes.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Passing user-supplied cookies, tokens, or POST data directly to unserialize().
• Believing that a HMAC on the serialized string is sufficient — if the verification is bypassable, it isn't.
• Not using json_decode() or other format-specific parsers when PHP object serialization is not needed.
• Using unserialize() with allowed_classes but not restricting the class list tightly enough.

Code Examples

// Deserialising untrusted data — attacker crafts a payload
// that triggers arbitrary PHP object instantiation
$data = unserialize($_COOKIE['session']);
// Any class with __wakeup() or __destruct() in scope
// can be chained into a POP chain for RCE

// Never unserialize untrusted input — use JSON instead
$data = json_decode(base64_decode($_COOKIE['session']), true);

// If you must use serialization, whitelist allowed classes:
$data = unserialize($input, ['allowed_classes' => [SafeValueObject::class]]);

// Best: sign the payload so tampering is detected
$payload = base64_encode(json_encode($data));
$sig     = hash_hmac('sha256', $payload, $_ENV['SECRET']);
$cookie  = $payload . '.' . $sig;

// Verify on read:
[$payload, $sig] = explode('.', $cookie, 2);
if (!hash_equals(hash_hmac('sha256', $payload, $_ENV['SECRET']), $sig)) abort(400);
$data = json_decode(base64_decode($payload), true);

References

• ↗ https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
• ↗ https://cwe.mitre.org/data/definitions/502.html

Tags

Related Terms