Summary
EspoCRM contains an unsafe PHP object deserialization vulnerability in background MassAction and Export processing. An authenticated administrator who can submit crafted serialized object data may cause attacker-controlled objects to be instantiated and potentially execute arbitrary code on the server.
EspoCRM contains an unsafe PHP object deserialization vulnerability in background MassAction and Export processing. An authenticated administrator who can submit crafted serialized object data may cause attacker-controlled objects to be instantiated and potentially execute arbitrary code on the server.
Affected context
The vulnerability affects EspoCRM deployments where administrator-controlled parameters for background MassAction or Export operations are persisted and later passed to PHP deserialization routines. Risk is present when serialized data is accepted without restricting object classes or enforcing a trusted data format before deferred processing.
The vulnerability affects EspoCRM deployments where administrator-controlled parameters for background MassAction or Export operations are persisted and later passed to PHP deserialization routines. Risk is present when serialized data is accepted without restricting object classes or enforcing a trusted data format before deferred processing.
Exploit preconditions
- Attack surface: Background MassAction and Export parameter handling
- Required access: Authenticated administrator-level access or equivalent ability to submit affected parameters
- Trigger point: Later background-job processing that deserializes stored PHP object data
- Why exploitation is possible: The deserialization paths permit attacker-controlled object instantiation without an effective allowed-class restriction
- Attack surface: Background MassAction and Export parameter handling
- Required access: Authenticated administrator-level access or equivalent ability to submit affected parameters
- Trigger point: Later background-job processing that deserializes stored PHP object data
- Why exploitation is possible: The deserialization paths permit attacker-controlled object instantiation without an effective allowed-class restriction
Why this happens
The underlying flaw is the use of unrestricted PHP object deserialization on data that can be influenced by an authenticated administrator. PHP deserialization may invoke class-specific behavior while reconstructing objects, so accepting arbitrary serialized objects can turn data processing into code execution when suitable classes or application behaviors are available. This maps to CWE-502, Unsafe Deserialization.
The underlying flaw is the use of unrestricted PHP object deserialization on data that can be influenced by an authenticated administrator. PHP deserialization may invoke class-specific behavior while reconstructing objects, so accepting arbitrary serialized objects can turn data processing into code execution when suitable classes or application behaviors are available. This maps to CWE-502, Unsafe Deserialization.
Potential impact
- An attacker may execute arbitrary code with the privileges of the application process.
- The server could be compromised or used for unauthorized access to application data.
- Sensitive customer, user, or business information could be exposed.
- Attackers could alter CRM records, disrupt background processing, or establish persistence.
- A compromised application process could enable further movement within the hosting environment.
- An attacker may execute arbitrary code with the privileges of the application process.
- The server could be compromised or used for unauthorized access to application data.
- Sensitive customer, user, or business information could be exposed.
- Attackers could alter CRM records, disrupt background processing, or establish persistence.
- A compromised application process could enable further movement within the hosting environment.
General mitigation guidance
Mitigation generally focuses on removing unsafe object deserialization from
attacker-influenced workflows.
Common defensive patterns include:
- Prefer a data-only format such as JSON with explicit schemas over native PHP object serialization.
- Use safe deserialization modes that allow only narrowly defined classes when object serialization cannot be avoided.
- Treat persisted job parameters as untrusted input and validate their types, structure, and permitted values before processing.
- Keep background workers and application processes under least-privilege service accounts.
- Separate job execution privileges from administrative and operating-system privileges.
- Avoid invoking magic methods or dynamic class behavior based solely on serialized input.
- Apply integrity controls and access restrictions to stored job parameters.
Mitigation generally focuses on removing unsafe object deserialization from
attacker-influenced workflows.
Common defensive patterns include:
- Prefer a data-only format such as JSON with explicit schemas over native PHP object serialization.
- Use safe deserialization modes that allow only narrowly defined classes when object serialization cannot be avoided.
- Treat persisted job parameters as untrusted input and validate their types, structure, and permitted values before processing.
- Keep background workers and application processes under least-privilege service accounts.
- Separate job execution privileges from administrative and operating-system privileges.
- Avoid invoking magic methods or dynamic class behavior based solely on serialized input.
- Apply integrity controls and access restrictions to stored job parameters.
How teams detect issues like this
Organizations can look for:
- Static-analysis findings involving PHP unserialization of request data, database values, queue messages, or other externally influenced input.
- Code-review signals such as unrestricted calls to native deserialization functions and missing allowed-class policies.
- Data-flow analysis tracing administrator-controlled parameters into deferred job handlers.
- Runtime monitoring for unexpected class names, serialization markers, child processes, or anomalous commands from background workers.
- Policy enforcement that requires schema-based, data-only formats for queued and persisted parameters.
- Automated security review tools configured to flag unsafe deserialization APIs and missing trust-boundary validation.
Organizations can look for:
- Static-analysis findings involving PHP unserialization of request data, database values, queue messages, or other externally influenced input.
- Code-review signals such as unrestricted calls to native deserialization functions and missing allowed-class policies.
- Data-flow analysis tracing administrator-controlled parameters into deferred job handlers.
- Runtime monitoring for unexpected class names, serialization markers, child processes, or anomalous commands from background workers.
- Policy enforcement that requires schema-based, data-only formats for queued and persisted parameters.
- Automated security review tools configured to flag unsafe deserialization APIs and missing trust-boundary validation.
