hunting-php-object-injection-pop-chains

Hunting PHP object injection and POP chains: when a string rebuilds into an attack

PHP object injection follows the same shape as Java gadget chains but through a different trigger. When unserialize runs on attacker-controlled data, it reconstructs arbitrary objects of any class already loaded, and PHP's magic methods, __wakeup, __destruct, __toString, __call, run automatically during or shortly after reconstruction. A property-oriented programming chain stitches these methods across ordinary classes so that reconstruction alone drives a file write, a system command, or a query. The same trigger hides inside phar:// stream handling: a filesystem function given an attacker-chosen path deserializes the archive's metadata without any explicit unserialize call. You find these by locating every deserialization trigger, explicit or implicit, and asking which loaded classes carry a magic method that starts a chain.

When to use

• A PHP application calls unserialize on request data, a cookie, a cache entry, or a stored value.
• A filesystem function receives an attacker-influenced path that could carry a phar:// wrapper.
• Application or library classes define magic methods with side effects that a chain could reach.

Scope check

Test object injection only against applications you own or are authorized to assess, on non-production data. A confirming chain runs a side effect on the target, a file write or a command, so treat each proof as a live intrusion within the authorized scope. If you can't name the authorization, stop.

The loop

1. Establish the deserialization triggers first. Inventory every unserialize on untrusted data and every filesystem call, file_exists, fopen, md5_file, getimagesize, and their siblings, that takes a path an attacker can steer into a phar:// wrapper. This is the false-positive killer: a magic-method chain is inert unless one of these triggers fires on attacker input. Name the triggers, then look for chains.