1. Bug Topic

Insecure PHP object deserialization in PhpBench\Serializer\XmlDecoder when decoding XML report parameters.

2. Release Version / Commit Hash / Affected Range

composer.json identifies the package as phpbench/phpbench with branch alias dev-master: 1.2-dev. Exact commit hash was not included.

3. Bug Type

Insecure deserialization / PHP object injection.

4. CWE

CWE-502: Deserialization of Untrusted Data.

5. Bug Summary

When decoding XML report parameters, PhpBench calls unserialize(base64_decode(...)) for parameters with type="serialized". XML files can be supplied through phpbench report --file and baseline-related command flows, so a malicious XML report can instantiate attacker-controlled PHP objects.

6. Root Cause

XmlDecoder::getParameters() assumes serialized parameter data is trusted internal data. It does not pass allowed_classes => false, does not restrict classes, and does not validate the decoded value before unserializing.

7. Attack Preconditions

A user or CI job processes an attacker-controlled XML report file with PhpBench. Exploit severity depends on loaded classes and available PHP magic-method gadget chains.

8. Impact Analysis

The primitive can trigger magic methods such as __wakeup() during XML decoding. Depending on the runtime class set, impact may range from unexpected side effects to arbitrary file writes or code execution through gadget chains.

9. Affected Code

• lib/Serializer/XmlDecoder.php::getParameters() raw unserialize(base64_decode(...)) for PARAM_TYPE_SERIALIZED.
• lib/Console/Command/Handler/SuiteCollectionHandler.php::suiteCollectionFromInput() accepts --file and calls decodeFiles().
• ReportCommand and RunCommand expose this path through command-line workflows.

10. PoC

Use the standalone PoC in https://github.com/fa1c4/security-advisories/tree/main/phpbench:

docker build -t poc-phpbench-xml-deserialization .
docker run --rm poc-phpbench-xml-deserialization

Successful output contains:

[VULNERABLE] unserialize() instantiated an attacker-controlled object and executed __wakeup during XML decoding.