php-serialization-audit

PHP serialization and template class vulnerability source code audit

This skill focuses on determining at the source code level whether "deserialization/XXE/SSTI holds", the core being to verify data controllability and security configuration on the Source→Sink path. Runtime techniques such as constructing payloads and chain exploitation belong to the scope of the corresponding black-box exploit skill.

In-depth reference

• Dangerous patterns of 3 types of vulnerabilities / secure pattern code comparison / EVID evidence examples → references/deser-patterns.md

---

3 types of vulnerabilities quick reference table

Type	Typical Sink	Exploitation conditions	Severity
Deserialization	unserialize, phar:// Trigger functions	User-controllable serialized data + available Gadget classes	Critical
XXE	DOMDocument::loadXML, simplexml_load_string, XMLReader::xml	External entities not disabled + user-controllable XML input	High-Critical
SSTI	Twig::render, Smarty::display, Blade {!! !!}, eval	User input directly enters the template rendering context	Critical

Deserialization audit key points

• unserialize() entry points: Search all unserialize calls, trace parameter sources (Cookie, Session, cache, database, HTTP request body), determine whether user-controllable
• Phar deserialization: file_exists/is_dir/fopen/filesize/copy and 40+ filesystem functions automatically trigger deserialization when processing the phar:// protocol, check whether path parameters are user-controllable
• POP chain search: Starting from the __destruct/__wakeup/__toString entry point, trace along chained method calls to dangerous Sinks (file write/command execution/SQL operations). Focus on Gadget classes in Composer dependencies
• allowed_classes restriction: unserialize($data, ['allowed_classes' => [...]]) Is it effective? Empty array [] or false is completely safe,true(default) imposes no restriction

XXE audit key points

• libxml_disable_entity_loader: In PHP < 8.0, it is necessary to explicitly call libxml_disable_entity_loader(true) to disable external entities. In PHP 8.0+ this function is deprecated and disabled by default, but the LIBXML_NOENT flag can still re-enable it
• DOMDocument risk: loadXML($input, LIBXML_NOENT) is the biggest risk point, this flag expands external entities. Even without passing LIBXML_NOENT, PHP < 8.0 may still load entities by default
• SimpleXML/XMLReader: simplexml_load_string is safe by default (PHP 8.0+), but the LIBXML_NOENT flag makes it dangerous;XMLReader::xml is the same
• Blind XXE vs out-of-band: Is the parsing result echoed to the page? When there is no echo, check whether an out-of-band channel (HTTP/FTP/DNS) can be exploited

SSTI audit key points

• Twig: Ordinary {{ user_input }} variable output usually just renders variables and is protected by automatic escaping; SSTI focuses on checking whether user input enters the template source code parsing process, such as createTemplate($userInput), dynamically concatenated template strings, or sandbox mode sandbox policy being too permissive (allowing dangerous filter/function)
• Smarty: {php} tags (deprecated in Smarty 3.1+ but possibly not disabled),{if} injecting PHP function calls in expressions ({if system('id')}{/if}）
• Blade: {!! $var !!} outputs unescaped content; if $var is user-controllable then XSS or more severe risk exists;@php directives, if injectable, lead directly to RCE
• Custom template engines: Search eval/preg_replace(/e) + string replacement mode, a common fatal combination in self-developed template engines

Checklist

• All unserialize call sites have been reviewed one by one for parameter sources
• The controllability of path parameters of Phar protocol trigger functions has been checked
• POP chain entry magic methods have been enumerated, and chain reachability has been traced
• allowed_classes Configuration has been verified, default value true has been marked
• The XML parser's LIBXML_NOENT flag usage has been confirmed
• libxml_disable_entity_loader call status has been checked (PHP < 8.0)
• The rendering method of user input in Twig/Smarty/Blade templates has been reviewed
• eval calls in custom template engines have been investigated
• Severity scoring uses a unified formula, consistent with the pipeline