PHAR Deserialization Attack

Also Known As

TL;DR

Explanation

PHAR (PHP Archive) files embed serialized PHP metadata in their stub. Any PHP file function (file_exists(), fopen(), copy(), rename(), include()) that operates on a phar:// URI will deserialize this metadata — triggering magic methods and enabling PHP Object Injection without a call to unserialize(). An attacker who can upload a file (even one with a safe extension like .jpg) and control a path passed to a file function can exploit this. Mitigations: disable the phar stream wrapper (Phar::unlinkArchive, stream_wrapper_unregister('phar')), validate file paths strictly, and use realpath() before file operations.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Allowing user file uploads to be passed to file_exists(), file_get_contents(), or similar — a phar:// URL triggers deserialization.
• Not disabling PHAR-based stream wrappers when user input is used in file paths.
• Mime-type checking uploads but not considering that .jpg files can be valid PHAR archives.
• Not restricting allowed PHP stream wrappers via allow_url_fopen and htaccess rules.

Code Examples

// User-controlled path triggers PHAR deserialization:
$file = $_GET['file'];
if (file_exists($file)) { // Attacker: ?file=phar://uploads/evil.jpg
    echo file_get_contents($file);
}

// Validate file paths — never pass user input to file functions:
function safeRead(string $userPath): string {
    // Realpath resolves .. and symlinks:
    $base = realpath('/var/www/uploads/');
    $full = realpath($base . '/' . basename($userPath));

    // Ensure resolved path is inside the allowed directory:
    if (!$full || !str_starts_with($full, $base . '/')) {
        throw new SecurityException('Path traversal attempt');
    }

    return file_get_contents($full);
}

// Disable phar stream wrapper if not needed:
stream_wrapper_unregister('phar');

// Validate file magic bytes, not extension:
$finfo = new \finfo(FILEINFO_MIME_TYPE);
$type  = $finfo->file($path); // Check actual content type

References

• ↗ https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
• ↗ https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-It's-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It-wp.pdf

Tags

Related Terms