{"action":"created","issue":{"url":"https://api.github.com/repos/slimphp/Slim/issues/1034","labels_url":"https://api.github.com/repos/slimphp/Slim/issues/1034/labels{/name}","comments_url":"https://api.github.com/repos/slimphp/Slim/issues/1034/comments","events_url":"https://api.github.com/repos/slimphp/Slim/issues/1034/events","html_url":"https://github.com/slimphp/Slim/issues/1034","id":59414092,"number":1034,"title":"PHP Object Injection Vulnerability in SessionCookie.php","user":{"login":"sarciszewski","id":3710836,"avatar_url":"https://avatars.githubusercontent.com/u/3710836?v=3","gravatar_id":"","url":"https://api.github.com/users/sarciszewski","html_url":"https://github.com/sarciszewski","followers_url":"https://api.github.com/users/sarciszewski/followers","following_url":"https://api.github.com/users/sarciszewski/following{/other_user}","gists_url":"https://api.github.com/users/sarciszewski/gists{/gist_id}","starred_url":"https://api.github.com/users/sarciszewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sarciszewski/subscriptions","organizations_url":"https://api.github.com/users/sarciszewski/orgs","repos_url":"https://api.github.com/users/sarciszewski/repos","events_url":"https://api.github.com/users/sarciszewski/events{/privacy}","received_events_url":"https://api.github.com/users/sarciszewski/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":59,"created_at":"2015-03-01T19:49:12Z","updated_at":"2015-03-02T02:41:58Z","closed_at":"2015-03-02T02:13:35Z","body":"https://github.com/slimphp/Slim/blob/master/Slim/Middleware/SessionCookie.php#L127\r\n\r\nGenerally, it's a bad idea to blindly `unserialize()` user-controllable input.\r\n\r\nhttps://www.owasp.org/index.php/PHP_Object_Injection\r\n\r\n**EDIT** - for people who don't want to read the whole thread:\r\n\r\nThe SessionCookie class is not used by default, you have to actually write your application to use it. So this means that the unserialize() -> RCE possibility is only for the select few apps that explicitly use this feature. The default is the native session driver, which is of course not vulnerable."},"comment":{"url":"https://api.github.com/repos/slimphp/Slim/issues/comments/76650847","html_url":"https://github.com/slimphp/Slim/issues/1034#issuecomment-76650847","issue_url":"https://api.github.com/repos/slimphp/Slim/issues/1034","id":76650847,"user":{"login":"sarciszewski","id":3710836,"avatar_url":"https://avatars.githubusercontent.com/u/3710836?v=3","gravatar_id":"","url":"https://api.github.com/users/sarciszewski","html_url":"https://github.com/sarciszewski","followers_url":"https://api.github.com/users/sarciszewski/followers","following_url":"https://api.github.com/users/sarciszewski/following{/other_user}","gists_url":"https://api.github.com/users/sarciszewski/gists{/gist_id}","starred_url":"https://api.github.com/users/sarciszewski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sarciszewski/subscriptions","organizations_url":"https://api.github.com/users/sarciszewski/orgs","repos_url":"https://api.github.com/users/sarciszewski/repos","events_url":"https://api.github.com/users/sarciszewski/events{/privacy}","received_events_url":"https://api.github.com/users/sarciszewski/received_events","type":"User","site_admin":false},"created_at":"2015-03-02T02:41:58Z","updated_at":"2015-03-02T02:41:58Z","body":"`utf_encode()` might better be known as `iso88591_to_utf8()`"}}