Unawakened Wakeup: A Novel PHP Object Injection Technique to Bypass __wakeup()

PHP object injection happens when untrusted input reaches unserialize(), letting an attacker shape the objects that get restored. Developers often add __wakeup() methods to block this, but such guards are not reliable, and some known bypasses are losing effect in newer PHP releases.

The talk focuses on a class-instantiation weakness: when an application builds a class from a user-supplied name without validation, the object is created without __wakeup() ever running. A class that does this can act as a link in a property-oriented gadget chain, so an attacker can reach a protected gadget indirectly. To show this is practical, the speaker revives an older Guzzle chain that a wakeup guard had broken, using gadgets from Flow, a PHP web framework, along with Doctrine. A live demonstration then runs a command against a test application, though only part of the demo was shown.

For defenders, the takeaway is to avoid native PHP serialization for untrusted data, move to JSON, or sign serialized payloads with an HMAC as the PHP manual recommends. For testers, dynamic instantiation points are worth searching for during code review, because they can widen what a deserialization bug is able to reach.