PHP : Phar Deserialization

Phar deserialization is a vulnerability which allows an attacker to execute any code in a vulnerable application. The vulnerability is in the serialized metadata of the phar file. It means that injected code is executed in the application’s scope. It happens with any file operation with the infected object. The necessary condition for the attack is the presence of a vulnerability that allows the user to control the paths for interaction with the file system, for example, when checking for the existence of the file or library loading.

If an operation with a file containing unserialized metadata is performed using phar:// prefix and the application has AnyClass class with __destruct() and __wakeup() methods, these methods will be called automatically.