# Technical Vulnerability Analysis & Security Report: Session Serialization Desynchronization PHP2Shell-CVE-2026-115560 ## Executive Summary This document provides an in-depth technical analysis of **CVE-2026-115560**, a critical vulnerability originating from session serialization handler desynchronization within PHP web applications. The condition occurs when the `session.serialize\_handler` directive is modified dynamically at runtime during the processing of unauthenticated session payloads—specifically through the `PHP\_SESSION\_UPLOAD\_PROGRESS` mechanism. When session handlers are mutated between write and read phases, the Zend Engine session subsystem experiences severe parser desynchronization and type confusion. This mismatch allows remote unauthenticated attackers to inject arbitrary session data structures. When paired with an unmitigated Local File Inclusion (LFI) primitive, this condition escalates to Remote Code Execution (RCE), enabling attackers to force the application process to write executable payloads (such as `info.php` in the public `htdocs` root directory). --- ## Technical Analysis & Vulnerability Architecture ### 1. Developer Architectural Flaw vs. Exploit Mechanism The primary application-level architectural flaw resides within dynamic page resolution logic (e.g., `app.php`). The code implements an unmitigated Local File Inclusion (LFI) vector: ```php <?php // Vulnerable dynamic inclusion in app.php include($\_GET\['page']); ?> ``` While `app.php` does not natively create files like `info.php` during standard baseline execution, it serves as the essential execution conduit. The vulnerability architecture separates into two components: 1. **The Application Conductor (`app.php`):** Provides unmitigated file inclusion capabilities and actively invokes session handling mechanisms. 2. **The Session Subsystem Substrate:** Acts as an arbitrary file storage mechanism, allowing controlled binary-to-text payload injection into temporary session files on disk. Exploit automation leverages `app.php` to target temporary session storage (`/tmp/sess\_SESSIONID`), using the LFI vector to force the Zend Engine to parse and execute the corrupt session payload. --- ### 2. Execution Chain & Visual Flow ``` \[Attacker Request] ──> (1) PHP\_SESSION\_UPLOAD\_PROGRESS Payload (php\_serialize) &#x20; │ &#x20; ▼ &#x20; \[Session File] ──> Stored as serialized array &#x20; │ &#x20; ▼ &#x20; (2) Dynamic Handler Switch ──> ini\_set('session.serialize\_handler', 'php') &#x20; │ &#x20; ▼ &#x20; (3) session\_start() ──> Parser Desynchronization via '|' Delimiter &#x20; │ &#x20; ▼ &#x20; (4) LFI Inclusion via app.php ──> Code Execution ──> Dropped Payload (info.php) ``` 1. **Initial Session Setup (`php\_serialize` Handler):** The application initializes using `php\_serialize`. When an unauthenticated user uploads a file with `PHP\_SESSION\_UPLOAD\_PROGRESS` enabled, PHP populates `$\_SESSION` with progress details written as a standard serialized array: `a:1:{s:4:"key";s:5:"value";}` 2. **Dynamic Handler Switching (`php` Handler):** During execution, the application or a module dynamically alters the handler via `ini\_set('session.serialize\_handler', 'php')`. The legacy `php` handler relies on a pipe-delimited format (`key\_name|serialized\_data`). 3. **Session Re-initialization & Parser Desynchronization:** When `session\_start()` is called under the updated `php` handler, the deserializer interprets any pipe character (`|`) as a structural key-value boundary marker. By embedding a pipe character inside the string key of the upload progress payload, the attacker tricks the deserializer into treating trailing data as an injectable top-level serialized structure. 4. **Code Execution & Arbitrary File Drop:** When `app.php` executes `include($\_GET\['page'])` targeting the temporary session file path (`?page=/tmp/sess\_ID`), the Zend Engine evaluates the injected PHP code payload inside the session file: ```php <?php file\_put\_contents(\_\_DIR\_\_ . '/info.php', '<?php phpinfo(); ?>'); ?> ``` This executes in the application's security context and drops `info.php` directly into the web root directory (`htdocs`). --- ## Root Cause Analysis | Vulnerability Component | Technical Description | Risk Factor | | :--- | :--- | :--- | | **Flawed Handler Transitions** | Inconsistent session storage representations caused by switching `session.serialize\_handler` dynamically at runtime. | Disrupts payload boundary enforcement between write and read phases. | | **Unsanitized Progress Keys** | `PHP\_SESSION\_UPLOAD\_PROGRESS` keys accept unfiltered user input, including structural control characters (`\\|`, NULL bytes). | Injection Primitive | | **Parser Desynchronization** | The legacy `php` handler deserializer evaluates structural boundaries based on raw pipe symbols, misinterpreting string boundaries set by `php\_serialize`. | Results in type confusion and variable injection. | --- ## Impact Assessment - **Severity:** **CRITICAL** - **Remote Code Execution (RCE):** Full arbitrary code execution under the privileges of the web server daemon user (`www-data`, `apache`, or `SYSTEM`). - **Persistence & File Dropping:** Attackers can drop persistent web shells or proof files (`info.php`) to establish permanent footholds. - **Data Compromise:** Unrestricted read/write access to local system resources, database credentials, and internal environment configurations. --- ## Remediation Strategies 1. **Standardize Session Handling Configuration:** Enforce a single, consistent `session.serialize\_handler` setting (preferably `php\_serialize`) in `php.ini`. Avoid modifying session handlers dynamically at runtime via `ini\_set()`. 2. **Disable Dynamic Upload Progress Ingestion:** If real-time upload progress tracking is not required, disable the upload progress facility in `php.ini`: ```ini session.upload_progress.enabled = Off ``` 3. **Remediate Local File Inclusion (LFI) Vectors:** Refactor dynamic file inclusions in `app.php` to rely on strict allowlists rather than raw, unvalidated user input: ```php <?php $allowed_pages = [ 'home' => 'views/home.php', 'about' => 'views/about.php' ]; $page = $_GET['page'] ?? 'home'; if (array_key_exists($page, $allowed_pages)) { include $allowed_pages[$page]; } ?> ``` 4. **Restrict Web Root Directory Permissions:** Enforce strict POSIX permission hierarchies on the web root (`htdocs`). Ensure that write permissions are revoked for the web server runtime user (`www-data` / `apache`) to prevent arbitrary file creation. 5. Demo https://odysee.com/@nu11secur1ty:b/PHP2Shell-CVE-2026-115560:5 https://github.com/nu11secur1ty/CVE-mitre/tree/main/2026/CVE-2026-115560