---------------------------------------------------------------------------
PEAR HTML_AJAX <= 0.5.7 (PHP Serializer) PHP Object Injection Vulnerability
---------------------------------------------------------------------------
[-] Software Link:
https://pear.php.net/package/HTML_AJAX
[-] Affected Versions:
All versions from 0.3.0 to 0.5.7.
[-] Vulnerability Description:
The vulnerable code is located within the HTML_AJAX_Serializer_PHP class defined into
the /AJAX/Serializer/PHP.php script. Such a class uses the unserialize() PHP function
with user-controlled input unless a class name which is not in the provided array
of allowed classes is found within the serialized string. Class names are
extracted by using the _getSerializedClassNames() method:
68. function _getSerializedClassNames($string) {
69. // Strip any string representations (which might contain object syntax)
70. while (($pos = strpos($string, 's:')) !== false) {
71. $pos2 = strpos($string, ':', $pos + 2);
72. if ($pos2 === false) {
73. // invalidly serialized string
74. return false;
75. }
76. $end = $pos + 2 + substr($string, $pos + 2, $pos2) + 1;
77. $string = substr($string, 0, $pos) . substr($string, $end);
78. }
79.
80. // Pull out the class names
81. preg_match_all('/O:[0-9]+:"(.*)"/U', $string, $matches);
82.
83. // Make sure names are unique (same object serialized twice)
84. return array_unique($matches[1]);
85. }
By default the array of allowed classes is empty, meaning that no classes are allowed
to be unserialized. However, due to the faulty regular expression used at line 81, it
might be possible to bypass such a restriction by replacing "O:X" with "O:+X" from
within the serialized string, where X is the length of the class name. This can be
exploited by unauthenticated attackers to inject arbitrary PHP objects into the
application scope, allowing to perform "POP chain" attacks or exploit memory
corruption vulnerabilities within the PHP's serialization internals, potentially
leading to execution of arbitrary code on the web server.
[-] Solution:
Update to version 0.5.8 or disable the PHP Serializer.
[-] Disclosure Timeline:
[19/01/2017] - Issue reported to https://pear.php.net/bugs/bug.php?id=21165
[01/02/2017] - CVE number requested
[01/02/2017] - CVE number assigned
[02/02/2017] - Version 0.5.8 released: http://blog.pear.php.net/2017/02/02/security
[06/02/2017] - Public disclosure
[-] CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2017-5677 to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
http://karmainsecurity.com/KIS-2017-01
