Description

Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-06T15:17:19.190Z",
  "pubdate": "2026-08-06T15:17:19.190Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in Adrena versions <= 1.2.14. This security flaw allows remote, unauthenticated threat actors to supply maliciously crafted serialized data to vulnerable application endpoints.\nThe core impact of this vulnerability involves the potential execution of arbitrary code, insecure deserialization side effects, or further application compromise depending on the availability of compatible gadget chains within the application context.\nAffected systems include installations of Adrena running version 1.2.14 or earlier. The risk implications are severe, potentially leading to complete system compromise, unauthorized data access, or remote code execution without requiring valid user credentials.\nAttackers require network access to the vulnerable Adrena instance and the ability to interact with the specific input vector that handles insecure deserialization of user-supplied data.",
  "technicalDetails": "The vulnerability stems from insecure deserialization practices implemented within Adrena <= 1.2.14. Specifically, the application processes user-supplied input via PHP's native deserialization functions (such as unserialize()) without proper sanitization, validation, or type checking.\nThe vulnerable component resides within the codebase handling unauthenticated HTTP requests where serialized data is accepted and processed. Because the application does not restrict or validate the incoming object structures, an attacker can manipulate the input stream to instantiate arbitrary PHP classes currently declared or autoloaded within the application scope.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a malicious serialized PHP payload containing a specific gadget chain designed to trigger unintended method calls, such as __wakeup() or __destruct(), upon instantiation. Second, the attacker transmits this payload over the network via HTTP request to the vulnerable Adrena endpoint. Third, the application receives the payload and passes it directly to the insecure deserialization routine. Finally, PHP reconstructs the object graph, executing the attacker-controlled gadget chain and achieving the desired post-exploitation impact.\nNetwork exposure for this vulnerability is external, as the affected endpoints are reachable without authentication. Privilege requirements are nonexistent, allowing any unauthenticated remote user to initiate the attack sequence. The payload behavior depends heavily on the presence of specific class definitions and gadget chains within the application or its third-party dependencies, but successful exploitation can lead to arbitrary code execution, file manipulation, or denial of service."
}