serialize() / unserialize()

Also Known As

TL;DR

Explanation

unserialize() reconstructs PHP objects from a string, invoking magic methods like __wakeup() and __destruct() in the process. If the serialised payload is attacker-controlled, they can craft a Property Oriented Programming (POP) chain using classes already loaded in the application to achieve arbitrary code execution — a PHP Object Injection attack. Never call unserialize() on user-supplied input. Use JSON (json_encode/json_decode) for data exchange; if serialisation is required, use authenticated, signed payloads or a safe serialisation library.

Common Misconception

Why It Matters

Common Mistakes

• Unserializing any user-controlled data — cookies, URL parameters, database values from untrusted sources.
• Using serialize() for data exchange between systems — use JSON instead; it cannot trigger PHP object instantiation.
• Not using allowed_classes option in unserialize() to restrict which classes can be instantiated.
• Storing serialized data in cookies — the cookie is user-controlled and can be replaced with a crafted payload.

Code Examples

$obj = unserialize($_COOKIE['data']); // attacker-controlled

$data = json_decode(base64_decode($_COOKIE['data']), true); // use JSON for simple data

References

• ↗ https://www.php.net/manual/en/function.unserialize.php
• ↗ https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection

Tags

Related Terms