16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
45 lines
2.4 KiB
Plaintext
45 lines
2.4 KiB
Plaintext
Deserializing objects is security-sensitive. For example, it has led in the past to the following vulnerabilities:
|
|
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17672[CVE-2017-17672]: vBulletin: Unserialize PHP Code Execution
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000167[CVE-2018-1000167]: Jenkins Pipeline: arbitrary code execution vulnerability
|
|
|
|
Object deserialization from an untrusted source can lead to unexpected code execution. Deserialization takes a stream of bits and turns it into an object. If the stream contains the type of object you expect, all is well. But if you're deserializing data coming from untrusted input, and an attacker has inserted some other type of object, you're in trouble. Why? https://www.owasp.org/index.php/PHP_Object_Injection[A known attack scenario] involves the creation of a serialized PHP object with crafted attributes which will modify your application's behavior. This attack relies on https://php.net/manual/en/language.oop5.magic.php[PHP magic methods] like ``++__desctruct++``, ``++__wakeup++`` or ``++__string++``. The attacker doesn't necessarily need the source code of the targeted application to exploit the vulnerability, he can also rely on the presence of open-source component and use https://github.com/ambionics/phpggc[tools to craft malicious payloads].
|
|
|
|
== Ask Yourself Whether
|
|
|
|
* an attacker could have tampered with the source provided to the deserialization function
|
|
* you are using an unsafe deserialization function
|
|
|
|
You are at risk if you answered yes to any of those questions.
|
|
|
|
== Recommended Secure Coding Practices
|
|
|
|
To prevent insecure deserialization, it is recommended to:
|
|
|
|
* Use safe libraries that do not allow code execution at deserialization.
|
|
* Not communicate with the outside world using serialized objects
|
|
* Limit access to the serialized source
|
|
** if it is a file, restrict the access to it.
|
|
** if it comes from the network, restrict who has access to the process, such as with a Firewall or by authenticating the sender first.
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 24 Jul 2018, 15:27:18 Pierre-Yves Nicolas wrote:
|
|
CVE-2012-0694 doesn't contain any relevant information: nothing about the fact that it's related to deserialization.
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|