[Security] Restrict unserialize() allowed_classes in TaskProcessing distributed cache#60883
Conversation
getAvailableTaskTypes() stores a serialized array of ShapeDescriptor, ShapeEnumValue, and EShapeType values in the distributed cache and reads them back with bare unserialize() — no allowed_classes restriction. An attacker who can write to the distributed cache backend (e.g., via an unauthenticated Redis instance, SSRF to the cache server, or a cache-poisoning vulnerability) can inject a crafted PHP serialized payload containing a gadget chain and achieve Remote Code Execution when getAvailableTaskTypes() is next called. Restrict allowed_classes to the three value-object types actually stored in this cache entry (ShapeDescriptor, ShapeEnumValue, EShapeType). Any other class in the serialized string will become a harmless __PHP_Incomplete_Class without executing constructors or magic methods.
XananasX7
requested review from
Altahrim,
CarlSchwan,
leftybournes and
salmart-dev
and removed request for
a team
|
Closing as a duplicate of #60884 |
|
Hello there, We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process. Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6 Thank you for contributing to Nextcloud and we hope to hear from you soon! (If you believe you should not receive this message, you can add yourself to the blocklist.) |
3 participants
Summary
TaskProcessing\Manager::getAvailableTaskTypes()serializesShapeDescriptor,ShapeEnumValue, andEShapeTypeobjects into the distributed cache and reads them back with bareunserialize()— noallowed_classesrestriction.An attacker who can write to the distributed cache backend can inject a crafted PHP serialized payload containing a gadget chain and achieve Remote Code Execution when
getAvailableTaskTypes()is next called.Attack scenario
__destruct/__wakeup).getAvailableTaskTypes()call, the gadget chain fires → RCE.Fix
Restrict
allowed_classesto the three value-object types that are actually stored in this cache entry (ShapeDescriptor,ShapeEnumValue,EShapeType). Any other class in the serialized string becomes a harmless__PHP_Incomplete_Class.Files changed
lib/private/TaskProcessing/Manager.php— add explicitallowed_classestounserialize()