PHP Object Injection

Also Known As

TL;DR

Explanation

PHP Object Injection is the practical exploit of insecure deserialization. When unserialize() processes attacker-controlled input, it instantiates arbitrary classes already loaded in the application's autoloader and calls __wakeup(), __destruct(), and __toString() as part of reconstruction. Attackers craft Property Oriented Programming (POP) chains — sequences of magic method calls across multiple classes that together achieve a malicious effect. Tools like PHPGGC (PHP Generic Gadget Chains) automate POP chain generation for popular frameworks. The fix: never unserialize untrusted data.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Passing user-controlled cookies, GET/POST parameters, or database values to unserialize().
• Believing that base64 encoding or encryption of serialized data prevents injection — if the key is compromised or the encoding bypassable, it doesn't help.
• Using serialize()/unserialize() for caching or session storage of user-controllable data.
• Not auditing installed packages for gadget chains — popular frameworks have known deserialization gadgets.

Code Examples

// Deserializing user-controlled data:
$prefs = unserialize(base64_decode($_COOKIE['user_prefs']));
// Attacker crafts a serialized object with __destruct that writes a webshell

// Never unserialize user input — use JSON instead:
// Bad:
// $obj = unserialize($_COOKIE['prefs']);

// Safe: JSON for data exchange:
$prefs = json_decode($_COOKIE['prefs'] ?? '{}', true);
if (!is_array($prefs)) $prefs = [];

// If unserialize is absolutely needed, use allowed_classes:
$obj = unserialize($data, ['allowed_classes' => [SafeClass::class]]);
// Only SafeClass can be instantiated — gadget chains blocked

// Verify data integrity with HMAC before deserializing:
$expected = hash_hmac('sha256', $data, SECRET_KEY);
if (!hash_equals($expected, $signature)) {
    throw new SecurityException('Data tampered');
}
$obj = unserialize($data, ['allowed_classes' => false]);

References

• ↗ https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
• ↗ https://github.com/ambionics/phpggc

Tags

Related Terms