Bug->Doc #71101 [Ana]: serialize_handler must not be switched for existing sessions

Edit report at https://bugs.php.net/bug.php?id=71101&edit=1 ID: 71101 Updated by: cmb@php.net Reported by: taoguangchen at icloud dot com -Summary: PHP Session Data Injection Vulnerability +Summary: serialize_handler must not be switched for existing sessions Status: Analyzed -Type: Bug +Type: Documentation Problem Package: Session related Operating System: * PHP Version: Irrelevant Block user comment: N Private report: N New Comment: > What about adding a warning when the serialize handler is > changed? While this would be possible for this particular issue, it would not be possible for the more general case, because users might want to use different session.serialize_handlers for distinct sessions. While I doubt that there are good reasons to do this, we don't want to break BC. > Since the example code what switches serialize handler cannot > work at all for normal usage, I'm not sure if mitigation is worth > to have. That's the point! I think we should just document that the serialize_handler must not be switched for existing sessions, lest bad things may happen. Previous Comments: ------------------------------------------------------------------------ [2021-07-29 19:15:14] wilfried dot pascault at orange dot com Is this bug is related to the exploitation code released on Exploit-DB 2 days ago ? https://www.exploit-db.com/exploits/50156 ------------------------------------------------------------------------ [2016-11-09 00:10:49] love at sickpeople dot se What about adding a warning when the serialize handler is changed? If telling people about it is the option here, it should be done with a warning (ie actively). Or a E_NOTICE since it's strictly not an error. ------------------------------------------------------------------------ [2016-08-27 07:29:50] yohgaki@php.net s/what/that/ ------------------------------------------------------------------------ [2016-08-27 07:28:46] yohgaki@php.net In order to prevent this kind of mistake (Use of invalid serializer), we need to add some kind of signature in session data. Since the example code what switches serialize handler cannot work at all for normal usage, I'm not sure if mitigation is worth to have. ------------------------------------------------------------------------ [2016-01-01 02:29:38] stas@php.net As this requires specific (and erroneous) user action to trigger, I don't think it is a security issue. I leave it open in case somebody has any ideas of how to prevent such mistake. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=71101 -- Edit this bug report at https://bugs.php.net/bug.php?id=71101&edit=1