Description

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-01T21:18:36.310Z",
  "pubdate": "2026-09-01T21:18:36.310Z",
  "executiveSummary": "Cypht versions prior to 2.12.2 contain a critical PHP object injection vulnerability within the logout handler.\nThis security flaw arises from the insecure deserialization of user-supplied input provided through the back_query GET parameter.\nThe vulnerability allows an authenticated attacker to execute arbitrary operating system commands with the privileges of the web server process.\nSuccessful exploitation involves crafting a malicious PHP object graph, base64-encoding it, and submitting it to the vulnerable endpoint, which processes the input using the unserialize() function without any integrity or type validation.\nThis defect facilitates remote code execution (RCE) via gadget-chain exploitation, posing a severe risk to the confidentiality, integrity, and availability of the host system.\nThe vulnerability is limited to authenticated users, though the lack of an allow-list or signature check significantly lowers the bar for exploitation by malicious actors who have gained valid session access to the application.",
  "technicalDetails": "The vulnerability is rooted in the improper handling of untrusted input in the Cypht logout handler component. Specifically, the application processes the back_query GET parameter by passing its base64-decoded content directly to the PHP unserialize() function.\nIn PHP, the unserialize() function is inherently dangerous when processing user-provided strings because it instantiates objects based on the serialized metadata. If the application environment contains 'gadget chains'—classes with magic methods such as __destruct(), __wakeup(), or __toString()—an attacker can control the internal state of these objects to trigger unintended code paths during the object lifecycle.\nThe attack flow proceeds as follows: First, the attacker identifies the application's available classes to construct a functional gadget chain. Second, the attacker generates a serialized PHP object payload designed to manipulate application logic or trigger a system-level function call (e.g., shell_exec or system). Third, the attacker base64-encodes this payload to ensure transport compatibility within the GET request.\nThe payload is then submitted via the back_query parameter to the logout handler. Upon receipt, the application decodes the base64 string and invokes unserialize() on the resulting data. Because there is no cryptographic signature (like an HMAC) or allow-list mechanism to restrict the classes that can be instantiated, the PHP engine reconstructs the malicious object graph.\nDuring the destruction or invocation phases of the instantiated objects, the gadget chain executes, leading to arbitrary command execution on the underlying server. This transition from a simple object injection to remote code execution is possible because the application process grants the injected code the same system permissions as the web server (e.g., www-data).\nThis vulnerability affects all Cypht versions before 2.12.2. The exploitation requires the attacker to be authenticated, meaning the primary attack vector involves leveraging an existing user session. Once authenticated, the attacker does not require further privileges to achieve full system compromise, as the deserialization process occurs before final session termination logic or further authorization checks are enforced on the parameter's content. Consequently, the impact is comprehensive, allowing for total system takeover, lateral movement within the network, and the exfiltration of sensitive application data."
}