Description

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-10T20:16:37.270Z",
  "pubdate": "2026-10-10T20:16:37.270Z",
  "executiveSummary": "CleanSkin versions 1.5.0 and below are susceptible to an unauthenticated PHP Object Injection vulnerability.\nThis vulnerability stems from the insecure deserialization of user-supplied input, allowing an attacker to instantiate arbitrary PHP objects within the application scope.\nThe impact of this flaw is severe, potentially facilitating Remote Code Execution (RCE), unauthorized file access, or privilege escalation, depending on the availability of exploitable 'POP' (Property-Oriented Programming) chains present within the application's codebase or included libraries.\nBecause the vulnerability is exploitable without authentication, any remote attacker with network access to the target system can trigger the deserialization process.\nThe flaw represents a significant security risk, as it bypasses standard access control mechanisms. Successful exploitation enables an attacker to manipulate application state, execute malicious logic, or exfiltrate sensitive data without requiring prior credentials.\nImmediate remediation is necessary to prevent potential system compromise.",
  "technicalDetails": "The vulnerability resides in the improper handling of serialized data passed through HTTP request parameters, cookies, or headers that are subsequently processed by the PHP unserialize() function.\nPHP Object Injection occurs when untrusted user input is passed to the unserialize() function without sufficient sanitization or validation. In CleanSkin versions 1.5.0 and earlier, the application fails to enforce strict type checking or signature verification on incoming serialized strings.\nWhen the unserialize() function processes a malicious payload, the PHP engine instantiates the objects specified in the input. If the application environment contains 'magic methods' (such as __destruct(), __wakeup(), or __toString()) within its defined classes, an attacker can manipulate object properties to alter the application's control flow.\nAn attacker leverages this behavior by constructing a specialized POP chain. By chaining together existing code constructs—specifically methods triggered during object destruction or wake-up—the attacker can achieve arbitrary file deletion, database manipulation, or full execution of system-level commands.\nThe exploitation flow typically involves: 1. Identification of an endpoint in CleanSkin that accepts serialized user data. 2. Crafting a serialized object graph that targets specific application classes or common libraries present in the environment. 3. Injecting the malicious payload via a crafted HTTP request. 4. Upon deserialization, the PHP engine invokes the magic methods defined in the injected objects, executing the attacker's desired code path.\nSince the vulnerability does not require authentication, the attack surface is globally exposed. The exploit is executed in the context of the web server process (e.g., www-data), meaning any subsequent code execution is constrained by the permissions assigned to the web server user.\nThe primary risk post-exploitation is Remote Code Execution, which grants the attacker full control over the application's operations and potentially the underlying host, facilitating data exfiltration, lateral movement, or the installation of persistent backdoors."
}