Later archive addition

Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization

Taoguang Chen · PHP

Shows that malformed PHP serialized objects can be created with attacker-controlled properties before parsing fails and skips __wakeup(). Destructors can then run without the defensive cleanup placed in __wakeup(). Further examples retain these partially initialized objects through custom deserialization or session decoding, allowing other magic methods to be invoked.

Record

Researcher

Taoguang Chen

Published by

PHP

In the archive

• Added to the 2016–17 archive after the original list was published

Tags

• php
• deserialization
• filter-bypass
• gadget-chain
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Taoguang Chen, first published at the original source. Preserved copies are kept so the citation survives its host.