3 ms·
So how is that a 'remote' exploit? Or is the definition of remote that you can already execute code on the server?
by adaml_623 12y ago
So how is that a 'remote' exploit? Or is the definition of remote that you can already execute code on the server?
- deweller 12y agoIf your app takes user input (like from a POSTed form variable or a URL parameter) and then calls unserialize on it, it becomes a remote exploit.
- jtreminio 12y agoThis is a developer making the mistake of trusting a user. At some point you have to draw a line in the sand when it comes to what is considered a bug in a language and developer error, right?
- noir_lord 12y agoTo be fair, If your program takes user input and calls unserialize on it then whoever wrote the program is an idiot at best * . > Warning > Do not pass untrusted user input to unserialize(). Unserialization can result in code being loaded and executed due to object instantiation and autoloading, and a malicious user may be able to exploit this. Use a safe, standard data interchange format such as JSON (via json_decode() and json_encode()) if you need to pass serialized data to the user. * Unless there is an absolute and specific case where you would need to do this, there might be but I'm struggling to think of one.
- cordite 12y agoOr the program takes user input and evals it, which includes unserialize. This can be the case for admin-web-based smart template editing and such. (bleh)
- feld 12y agoIt's a good thing there's no poorly written PHP in the wild and everyone is really, really good at patching PHP immediately upon update. /s edit: http://blog.ircmaxell.com/2014/12/php-install-statistics.html http://blog.ircmaxell.com/2014/12/php-install-statistics.htm...
- raziel2p 12y agoI don't think you'll be able to exploit it remotely directly, but indirectly this sort of thing is more realistic. For example, many popular PHP applications store serialized data as strings in its database. An SQL exploit like the one Drupal had some time ago could allow an attacker to modify that data.
- adaml_623 12y agoAh thanks. I was looking at the code and thinking that the serialize step was part of the exploit but of course it isn't.
- maplesyrupguy 12y agoBlog author here. It's remote(unlike part one, where we declared variables and such) due to the fact that the exploit will work if the site takes user input and unserializes it. (For instance: a certain popular adult entertainment billing system).