Summary
PHPOffice PHPPresentation contains an unsafe deserialization vulnerability in the handling of crafted presentation archives. If an attacker can submit a malicious presentation file that reaches the affected loading path, they may instantiate arbitrary PHP objects, potentially resulting in code execution, file writes, or denial of service.
PHPOffice PHPPresentation contains an unsafe deserialization vulnerability in the handling of crafted presentation archives. If an attacker can submit a malicious presentation file that reaches the affected loading path, they may instantiate arbitrary PHP objects, potentially resulting in code execution, file writes, or denial of service.
Affected context
The vulnerability occurs when PHPPresentation processes an uploaded or otherwise attacker-influenced presentation archive containing a PhpPresentation.xml file. In affected deployment patterns, IOFactory::load passes serialized content to PHP deserialization without sufficiently restricting the objects that may be instantiated, making exploitation possible when untrusted presentation files are accepted.
The vulnerability occurs when PHPPresentation processes an uploaded or otherwise attacker-influenced presentation archive containing a PhpPresentation.xml file. In affected deployment patterns, IOFactory::load passes serialized content to PHP deserialization without sufficiently restricting the objects that may be instantiated, making exploitation possible when untrusted presentation files are accepted.
Exploit preconditions
- Attack surface: Presentation-file upload or another workflow that loads externally supplied presentation archives
- Required access: Ability to provide or place a crafted presentation file where the application will process it
- Trigger point: Loading and parsing of
PhpPresentation.xmlthroughIOFactory::load - Why exploitation is possible: Serialized data is processed by
unserialize()without adequate restrictions on object instantiation - Environmental dependency: Impact depends on available PHP classes, gadget chains, filesystem permissions, and application privileges
- Attack surface: Presentation-file upload or another workflow that loads externally supplied presentation archives
- Required access: Ability to provide or place a crafted presentation file where the application will process it
- Trigger point: Loading and parsing of
PhpPresentation.xmlthroughIOFactory::load - Why exploitation is possible: Serialized data is processed by
unserialize()without adequate restrictions on object instantiation - Environmental dependency: Impact depends on available PHP classes, gadget chains, filesystem permissions, and application privileges
Why this happens
The underlying flaw is the use of native PHP deserialization on data that may be controlled by an untrusted party. PHP's unserialization behavior can instantiate classes and invoke relevant lifecycle methods, allowing application-provided gadget chains to perform unintended operations. This behavior maps to CWE-502, Unsafe Deserialization, because serialized input is treated as trusted object state rather than constrained data.
The underlying flaw is the use of native PHP deserialization on data that may be controlled by an untrusted party. PHP's unserialization behavior can instantiate classes and invoke relevant lifecycle methods, allowing application-provided gadget chains to perform unintended operations. This behavior maps to CWE-502, Unsafe Deserialization, because serialized input is treated as trusted object state rather than constrained data.
Potential impact
- An attacker may achieve code execution within the PHP application's security context.
- An attacker could write, modify, or delete files permitted to the application.
- The application may experience denial of service through malformed or resource-intensive input.
- Application data or credentials could be exposed or altered.
- A compromised process could be used for further attacks, depending on host and service privileges.
- An attacker may achieve code execution within the PHP application's security context.
- An attacker could write, modify, or delete files permitted to the application.
- The application may experience denial of service through malformed or resource-intensive input.
- Application data or credentials could be exposed or altered.
- A compromised process could be used for further attacks, depending on host and service privileges.
General mitigation guidance
Mitigation generally focuses on eliminating unsafe deserialization of
attacker-controlled presentation content.
- Prefer format parsers that produce constrained data structures rather than native PHP objects.
- Avoid passing untrusted content to
unserialize(); where legacy compatibility requires serialized data, use tightly restricted allowed-class behavior and validate the resulting structure. - Enforce file-type, archive-content, schema, size, and resource limits before processing.
- Store and process uploaded files in isolated locations with non-executable permissions.
- Run document-processing workers with least privilege and minimal filesystem, network, and credential access.
- Treat uploaded presentations as untrusted even after extension or MIME-type checks, and apply layered validation before loading them.
Mitigation generally focuses on eliminating unsafe deserialization of
attacker-controlled presentation content.
- Prefer format parsers that produce constrained data structures rather than native PHP objects.
- Avoid passing untrusted content to
unserialize(); where legacy compatibility requires serialized data, use tightly restricted allowed-class behavior and validate the resulting structure. - Enforce file-type, archive-content, schema, size, and resource limits before processing.
- Store and process uploaded files in isolated locations with non-executable permissions.
- Run document-processing workers with least privilege and minimal filesystem, network, and credential access.
- Treat uploaded presentations as untrusted even after extension or MIME-type checks, and apply layered validation before loading them.
How teams detect issues like this
- Use static analysis rules to identify
unserialize()calls and deserialization wrappers reachable from upload or import paths. - Review data-flow paths from file uploads, archive extraction, and remote storage into presentation loaders.
- Flag object deserialization performed before schema, class, size, or content validation.
- Search for application classes with magic methods that could form deserialization gadget chains.
- Enforce repository and CI policies that prohibit unrestricted native deserialization for untrusted input.
- Monitor document-processing services for unexpected child processes, file writes, archive anomalies, and repeated parser failures.
- Automated security review tools may help identify unsafe deserialization sinks and attacker-controlled data flows.
- Use static analysis rules to identify
unserialize()calls and deserialization wrappers reachable from upload or import paths. - Review data-flow paths from file uploads, archive extraction, and remote storage into presentation loaders.
- Flag object deserialization performed before schema, class, size, or content validation.
- Search for application classes with magic methods that could form deserialization gadget chains.
- Enforce repository and CI policies that prohibit unrestricted native deserialization for untrusted input.
- Monitor document-processing services for unexpected child processes, file writes, archive anomalies, and repeated parser failures.
- Automated security review tools may help identify unsafe deserialization sinks and attacker-controlled data flows.
