PHP object injection in the absense of source code?

Question

I know the process of exploiting PHP object injection. I read somewhere that it can only be exploited when the attacker knows the internal code. Really? If I found a PHP object injection vulnerability and I don't know the source code of the web application, can I exploit it?

Answer 1

Exploiting a vulnerability without access to the source code requirs more work, some creativity and intuition and perhaps a dash of good luck. But it is absolutely possible. This is true for most attacks in general, and for PHP object injection in particular.

The idea that you are safe as long as no one gets their hands on your source code is not only wrong, it is dangerous. Instead, design your programs so that they are safe even if the source code would be made public.

To understand how this particular vulnerability could be exploited without knowledge of the source code, I recommend that you take a look at these examples from OWASP:

• In the first example, a GET variable containing a file path is passed through unserialize, thereby creating a path traversal vulnerability. Whenever a competent attacker sees a path, she will try path traversal to see what happends. Seeing the source code would make it easier, but it is not strictly necesarry.
• In the second example, data from unserialize is passed to eval, making code injection possible. Testing to insert PHP code at random places is pretty much standard black box pen testing procedure. Sure, it would be easier if you could just grep for eval, but that doesn't mean this little gem would go undiscovered.
• The third example is a SQLi vulnerability created by __tostring method being controlled by the attacker. This one would be tricky to find without reading the source code. But serialized PHP strings are easy to spot, and an attacker will poke around and see what happends. Do you really want to bet on that no one will strike gold just by pure dumb luck?