Edit report at https://bugs.php.net/bug.php?id=71101&edit=1
ID: 71101
Updated by: [email protected]
Reported by: taoguangchen at icloud dot com
-Summary: PHP Session Data Injection Vulnerability
+Summary: serialize_handler must not be switched for existing
sessions
Status: Analyzed
-Type: Bug
+Type: Documentation Problem
Package: Session related
Operating System: *
PHP Version: Irrelevant
Block user comment: N
Private report: N
New Comment:
> What about adding a warning when the serialize handler is
> changed?
While this would be possible for this particular issue,
it would not be possible for the more general case, because
users might want to use different session.serialize_handlers
for distinct sessions. While I doubt that there are good
reasons to do this, we don't want to break BC.
> Since the example code what switches serialize handler cannot
> work at all for normal usage, I'm not sure if mitigation is worth
> to have.
That's the point! I think we should just document that the
serialize_handler must not be switched for existing sessions, lest
bad things may happen.
Previous Comments:
------------------------------------------------------------------------
[2021-07-29 19:15:14] wilfried dot pascault at orange dot com
Is this bug is related to the exploitation code released on Exploit-DB 2 days ago ?
https://www.exploit-db.com/exploits/50156
------------------------------------------------------------------------
[2016-11-09 00:10:49] love at sickpeople dot se
What about adding a warning when the serialize handler is changed?
If telling people about it is the option here, it should be done with a warning (ie actively). Or a E_NOTICE since it's strictly not an error.
------------------------------------------------------------------------
[2016-08-27 07:29:50] [email protected]
s/what/that/
------------------------------------------------------------------------
[2016-08-27 07:28:46] [email protected]
In order to prevent this kind of mistake (Use of invalid serializer), we need to add some kind of signature in session data.
Since the example code what switches serialize handler cannot work at all for normal usage, I'm not sure if mitigation is worth to have.
------------------------------------------------------------------------
[2016-01-01 02:29:38] [email protected]
As this requires specific (and erroneous) user action to trigger, I don't think it is a security issue. I leave it open in case somebody has any ideas of how to prevent such mistake.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=71101
--
Edit this bug report at https://bugs.php.net/bug.php?id=71101&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.