0day.today - Biggest Exploit Database in the World.
![](/img/logo_green.jpg)
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earnGOLD
Administration of this site uses the official contacts. Beware of impostors!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
PHP yaml_parse_url Unsafe Deserialization Vulnerability
Title: PHP yaml_parse_url Unsafe Deserialization Credit: John Leitch (john@autosectools.com) Url1: http://autosectools.com/Page/PHP-yaml_parse_url-Unsafe-Deserialization Url2: https://bugs.php.net/bug.php?id=69617 Resolution: Fixed The PHP unserialize() function is considered unsafe due to its behavior regarding class instantiation; in cases where serialized data is attacker controlled, it can be tampered with, allowing for the instantiation of arbitrary PHP classes and thus code execution via destructor. Inversely, as per the documentation, the yaml_parse*() functions carry no such risk. In fact, among the YAML functions is yaml_parse_url, which retrieves and parses a remote YAML file. Deserialization of built-in YAML types appears safe, as the serializer utilizes arrays and scalar types, prohibiting control of instantiation. However, this limitation can be overcome with the largely undocumented !php/object extension type, which in turn invokes unserialize(), effectively making the yaml_parse* functions just as dangerous. An example follows: <?php class A { function __destruct() { echo 'destructor invoked'; } } yaml_parse('x: !php/object O:1:"A":0:{}'); ?> As mentioned previously, the yaml_parse_url function, which encourages the retrieval of YAML from remote endpoints, exhibits the same behavior: <?php class A { function __destruct() { echo 'destructor invoked'; } } yaml_parse_url('http://autosectools.com/yaml.txt'); ?> To mitigate this, it is recommended that the YAML serializer handle the !php/object type in a safe manner, such as prohibiting the deserialization of types that have destructors defined. If this is not possible, it is recommended that yaml_parse_url be removed and the documentation for the remaining yaml_* functions be updated with warnings akin to that of unserialize(). # 0day.today [2024-06-24] #