1206
PHP Object Injection : Some PHP application researchers use this term when attacking unsafe
use of the unserialize() function; but it is also used for CWE-915.
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
Unexpected State
Attackers can modify unexpected objects or data that was
assumed to be safe from modification.
Availability DoS: Resource Consumption (CPU)
If a function is making an assumption on when to
terminate, based on a sentry in a string, it could easily
never terminate.
Other Varies by Context
The consequences can vary widely, because it depends on
which objects or methods are being deserialized, and how
they are used. Making an assumption that the code in the
deserialized object is valid is dangerous and can enable
exploitation.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
If available, use the signing/sealing features of the programming language to assure that
deserialized data has not been tainted. For example, a hash-based message authentication code
(HMAC) could be used to ensure that data has not been modified.
Phase: Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that
the data flows through safe input validation and that the functions are safe.
Phase: Implementation
Explicitly define a final object() to prevent deserialization.
Phase: Architecture and Design
Phase: Implementation
Make fields transient to protect them from deserialization. An attempt to serialize and then
deserialize a class containing transient fields will result in NULLs where the transient data should
be. This is an excellent way to prevent time, environment-based, or sensitive variables from
being carried over and used improperly.
CWE Version 4.14
CWE-502: Deserialization of Untrusted Data
CWE-502: Deserialization of Untrusted Data