Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75084
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <53AB709C.1000809@sugarcrm.com>
References: <CAH-PCH6xEXspisLOHtiTbViA4vDTk7q6LM3t_Bh9Dzr1cj_Nag@mail.gmail.com>
 <53A1C722.9060501@fedoraproject.org> <53A21137.6010705@sugarcrm.com>
 <CAMUwpuT_S2EE6cdJM95RzY4vmORGx3vJ9+gau8G3EZCMsNSydA@mail.gmail.com>
 <53A2A9BD.1070603@sugarcrm.com> <CAH-PCH5-vtCVvGvceMqt6rDXq4zo0Vb34cyDK3KdBUNfg_oLyg@mail.gmail.com>
 <CADyq6sKQbV+Avzfs3OAdGM9Hc85i18t0LSATD6Rk=HjqKOMgBg@mail.gmail.com>
 <53A3874E.20704@sugarcrm.com> <CAH-PCH6nSk0ir_TSjhCd0BVhiY5UsOsLKzqKhqfaU1G0ghi4Tg@mail.gmail.com>
 <53A65578.6000701@sugarcrm.com> <CAH-PCH7tw0=OacG2HFDvBZxAho0HjdOtpLR=J9aXYGxsv40ehA@mail.gmail.com>
 <53A8626B.701@fedoraproject.org> <53A866B6.4060501@sugarcrm.com>
 <53A92B24.40706@fedoraproject.org> <53A92F93.2060507@sugarcrm.com>
 <op.xhyd07yec9evq2@nikita-optiplex-9020> <53A9CC06.5060707@sugarcrm.com>
 <CADyq6s+nA0RhN87t_aYB9iC0YzEeoyvPwkkHBEz=evzAfU5RBw@mail.gmail.com> <53AB709C.1000809@sugarcrm.com>
Date: Thu, 26 Jun 2014 03:07:18 +0200
Message-ID: <CADyq6s+4SLUoNDFrTUKiqNM_ZVu7EBLNLTfW9Th6JS9v4j_D-g@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Nikita Nefedov <inefedor@gmail.com>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c2bc50a8ef8a04fcb2d1bd
Subject: Re: [PHP-DEV] Re: Bug 67072 resolution for 5.4/5.5
From: ocramius@gmail.com (Marco Pivetta)

--001a11c2bc50a8ef8a04fcb2d1bd
Content-Type: text/plain; charset=UTF-8

On 26 June 2014 03:00, Stas Malyshev <smalyshev@sugarcrm.com> wrote:

> Hi!
>
> > You keep mentioning these two, but don't they assume that the serialized
> > data is user-provided?
>
> Yes, they do.
>
> > I don't think anybody sane would/should do that in first place, as it
>
> Simple search on github suggests otherwise.
>

*sane* doesn't mean everyone.
Allowing un-serializing data coming from user input is as bad as `eval()`,
and trying to defend from it is also quite useless.


> > would be already possible to cause RCE just with any class implementing
> > the `Serializable` interface.
>
> Not sure how you could do that, could you please explain how would you
> cause that?
>

Assuming this exists in the user's codebase:

class Prank implements Serializable
{
    public function serialize() {}
    public function unserialize() { exec('rm -rf /'); }
}

Then send a serialized prank over the internets.
Other interesting security issues are related to this as well in my
opinion, but I'd have to do research on the problem first.


> I was, of course, speaking of running
> arbitrary code on C level, not just PHP methods purposed to handle the
> data by the developers.
>

That was my misunderstanding. Thanks for clarifying.


Marco Pivetta

http://twitter.com/Ocramius

http://ocramius.github.com/

--001a11c2bc50a8ef8a04fcb2d1bd--