1. Bug Topic
Insecure PHP object deserialization in PhpBench\Serializer\XmlDecoder when decoding XML report parameters.
2. Release Version / Commit Hash / Affected Range
composer.json identifies the package as phpbench/phpbench with branch alias dev-master: 1.2-dev. Exact commit hash was not included.
3. Bug Type
Insecure deserialization / PHP object injection.
4. CWE
CWE-502: Deserialization of Untrusted Data.
5. Bug Summary
When decoding XML report parameters, PhpBench calls unserialize(base64_decode(...)) for parameters with type="serialized". XML files can be supplied through phpbench report --file and baseline-related command flows, so a malicious XML report can instantiate attacker-controlled PHP objects.
6. Root Cause
XmlDecoder::getParameters() assumes serialized parameter data is trusted internal data. It does not pass allowed_classes => false, does not restrict classes, and does not validate the decoded value before unserializing.
7. Attack Preconditions
A user or CI job processes an attacker-controlled XML report file with PhpBench. Exploit severity depends on loaded classes and available PHP magic-method gadget chains.
8. Impact Analysis
The primitive can trigger magic methods such as __wakeup() during XML decoding. Depending on the runtime class set, impact may range from unexpected side effects to arbitrary file writes or code execution through gadget chains.
9. Affected Code
lib/Serializer/XmlDecoder.php::getParameters() raw unserialize(base64_decode(...)) for PARAM_TYPE_SERIALIZED.lib/Console/Command/Handler/SuiteCollectionHandler.php::suiteCollectionFromInput() accepts --file and calls decodeFiles().ReportCommand and RunCommand expose this path through command-line workflows.
10. PoC
Use the standalone PoC in https://github.com/fa1c4/security-advisories/tree/main/phpbench:
docker build -t poc-phpbench-xml-deserialization .
docker run --rm poc-phpbench-xml-deserialization
Successful output contains:
[VULNERABLE] unserialize() instantiated an attacker-controlled object and executed __wakeup during XML decoding.
1. Bug Topic
Insecure PHP object deserialization in
PhpBench\Serializer\XmlDecoderwhen decoding XML report parameters.2. Release Version / Commit Hash / Affected Range
composer.jsonidentifies the package asphpbench/phpbenchwith branch aliasdev-master: 1.2-dev. Exact commit hash was not included.3. Bug Type
Insecure deserialization / PHP object injection.
4. CWE
CWE-502: Deserialization of Untrusted Data.
5. Bug Summary
When decoding XML report parameters, PhpBench calls
unserialize(base64_decode(...))for parameters withtype="serialized". XML files can be supplied throughphpbench report --fileand baseline-related command flows, so a malicious XML report can instantiate attacker-controlled PHP objects.6. Root Cause
XmlDecoder::getParameters()assumes serialized parameter data is trusted internal data. It does not passallowed_classes => false, does not restrict classes, and does not validate the decoded value before unserializing.7. Attack Preconditions
A user or CI job processes an attacker-controlled XML report file with PhpBench. Exploit severity depends on loaded classes and available PHP magic-method gadget chains.
8. Impact Analysis
The primitive can trigger magic methods such as
__wakeup()during XML decoding. Depending on the runtime class set, impact may range from unexpected side effects to arbitrary file writes or code execution through gadget chains.9. Affected Code
lib/Serializer/XmlDecoder.php::getParameters()rawunserialize(base64_decode(...))forPARAM_TYPE_SERIALIZED.lib/Console/Command/Handler/SuiteCollectionHandler.php::suiteCollectionFromInput()accepts--fileand callsdecodeFiles().ReportCommandandRunCommandexpose this path through command-line workflows.10. PoC
Use the standalone PoC in
https://github.com/fa1c4/security-advisories/tree/main/phpbench:docker build -t poc-phpbench-xml-deserialization . docker run --rm poc-phpbench-xml-deserializationSuccessful output contains: