php-deser-audit

PHP Deserialization Audit (php-deser-audit)

Analyze PHP project source code, identify user-controllable data entering unserialize() or equivalent deserialization points, and in combination with the class's magic methods (__wakeup/__destruct/__call/__toString/{value}) determine whether an object injection exploitable chain exists.

Grading and Numbering

• See details:shared/SEVERITY_RATING.md
• Vulnerability ID:{C/H/M/L}-DESER-{序号}

Dangerous Sink (Required)

• unserialize($data)
• unserialize(base64_decode({value}))
• Any path that converts user input and then deserializes it

Controllability (Required)

Must trace and output:

• Where the deserialization input comes from: GET/POST/Cookie/Session/Header/database fields, etc.
• Whether base64/encryption/decoding/concatenation steps exist (may still be controllable)
• Whether validation/signature exists (such as hash_hmac) and whether the signature is reliable (evidence required)

Gadget Chain Identification (Required)

Must output:

• The object type after deserialization (or the set of possible types)
• The list of magic methods in that type's class and their trigger conditions
• The data flow chain of "from object creation -> magic method trigger -> final sensitive operation (such as file/command/SSRF/database)"

Tracer Trigger Conditions (Required)

• The deserialization input passes through multiple layers of decode/encapsulation
• The magic method chain spans multiple classes/files

Evidence Citation (Mandatory: from php-route-tracer)

For each suspected deserialization/object injection vulnerability, must cite item by item from the trace output the ## 9) Sink Evidence Type Checklist of the DESER linesCorresponding evidence points (status may be pending verification, but evidence citations must exist):

1. EVID_DESER_CALLSITE: Evidence of the deserialization call site location (unserialize or equivalent point)
2. EVID_DESER_INPUT_SOURCE: Evidence of the user-controllable source of the input
3. EVID_DESER_OBJECT_TYPE_MAGIC_TRIGGER_CHAIN: Evidence of the object type/magic method trigger conditions after deserialization (and evidence of the final sensitive operation point chain, if it can be located)

Handling of Missing Tracer Evidence (Mandatory)

• If any of the above key evidence points 1~3 cannot be located: the vulnerability status can only be marked as ⚠️待验证, and ✅已确认可利用。

Report Output

Output to:

{output_path}/vuln_audit/deser_{timestamp}.md

PoC (Mandatory, but marked as "Conceptual PoC/Verification PoC")

Must provide:

• The real route (or how the cookie/session field is used)
• The payload generation approach (if a real gadget payload cannot be generated, must provide "the parts that need manual completion" and explain the reason, while still retaining an executable framework and replaceable fields)