zakirkun PHP Insecure Deserialization
Overview
PHP's unserialize() function reconstructs PHP objects from a string representation. When called with user-controlled input, attackers can craft malicious serialized strings that:
- Invoke
__wakeup()and__destruct()magic methods - Chain gadgets from existing classes to achieve RCE
- Read/write arbitrary files
This is the basis of PHP Object Injection attacks.
Remediation
- Never call
unserialize()on user input - Use
json_decode()for data exchange - If deserialization is required, validate with
allowed_classesoption
Safe:
$data = json_decode($_POST['data'], true); // Safe alternative
// OR if PHP object needed, restrict classes:
$obj = unserialize($data, ['allowed_classes' => ['SafeClass']]);