Senior LevelPHP 8+
How do malicious Phar Stream Wrappers (phar://) lead to Remote Code Execution via file_exists()?
❓ Interview Prompt: Explain Phar Stream Wrapper deserialization vulnerabilities, how file_exists() parses Phar metadata, and preventing RCE exploits.
Even if an application never calls 'unserialize()' directly, file functions like 'file_exists()', 'is_executable()', or 'getimagesize()' can trigger automatic object deserialization if passed a 'phar://' stream wrapper.
How Phar Deserialization Operates:
1
Attacker uploads a malicious Phar archive disguised as a JPEG image ('avatar.jpg').
2
Attacker triggers a file function on 'phar:///uploads/avatar.jpg'.
3
The PHP 'phar://' stream handler automatically reads the Phar archive manifest and unserializes embedded object metadata, executing POP chain RCE automatically!
•
Mitigation: Disable 'phar' stream wrappers or validate file path prefixes.
Code Implementation Example
php
<?php
// ❌ VULNERABLE: file_exists() on user-controlled stream wrapper path!
// file_exists("phar:///uploads/user_avatar.jpg");
// ✅ SECURE: Validate that file path does NOT use stream wrappers!
function safeFileExists(string $path): bool {
if (str_starts_with($path, 'phar://') || str_contains($path, '://')) {
throw new InvalidArgumentException("Stream wrappers blocked!");
}
return file_exists($path);
}💡Blocking malicious phar:// stream wrapper execution in file_exists calls.
🎯 Interview Key Takeaway
file_exists() automatically unserializes Phar metadata when passed phar:// stream wrappers; validate user paths to block phar:// wrappers.
#Phar Deserialization#Stream Wrappers#Security#RCE#Senior
Back to all PHP 8+ Questions→