Top 10 winner

It's A PHP Unserialization Vulnerability Jim But Not As We Know It

Sam Thomas · Secarma Labs · 16 August 2018

Any PHP file operation on an attacker-controlled path beginning phar:// unserializes the archive's metadata, so file-existence checks, XXE and SSRF bugs become object injection. A Phar can be disguised as a valid JPEG to survive upload checks, and POP gadget chains then give code execution, shown against Typo3, WordPress and TCPDF via Contao.

Record

Researcher

Sam Thomas

Published by

Secarma Labs

Date

16 August 2018

Format

Recording

In the archive

• Ranked #6 in the 2018 Top 10 Web Hacking Techniques

Related sources

• Whitepaper

Tags

• deserialization
• gadget-chain
• rce
• file-upload
• php
• xxe
• ssrf
• wordpress
• owasp-a03-2021
• owasp-a08-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Sam Thomas, first published at the original source. Preserved copies are kept so the citation survives its host.