Title: PHP yaml_parse_url Unsafe Deserialization
Credit: John Leitch (john@autosectools.com)
Url1: http://autosectools.com/Page/PHP-yaml_parse_url-Unsafe-Deserialization
Url2: https://bugs.php.net/bug.php?id=69617
Resolution: Fixed

The PHP unserialize() function is considered unsafe due to its behavior regarding class instantiation; in cases where serialized data is attacker controlled, it can be tampered with, allowing for the instantiation of arbitrary PHP classes and thus code execution via destructor.

Inversely, as per the documentation, the yaml_parse*() functions carry no such risk. In fact, among the YAML functions is yaml_parse_url, which retrieves and parses a remote YAML file. Deserialization of built-in YAML types appears safe, as the serializer utilizes arrays and scalar types, prohibiting control of instantiation. However, this limitation can be overcome with the largely undocumented !php/object extension type, which in turn invokes unserialize(), effectively making the yaml_parse* functions just as dangerous. An example follows:

<?php 
class A {
    function __destruct() {
       echo 'destructor invoked';
    }
}

yaml_parse('x: !php/object O:1:"A":0:{}');
?>

As mentioned previously, the yaml_parse_url function, which encourages the retrieval of YAML from remote endpoints, exhibits the same behavior:

<?php 
class A {
    function __destruct() {
       echo 'destructor invoked';
    }
}

yaml_parse_url('http://autosectools.com/yaml.txt');
?>

To mitigate this, it is recommended that the YAML serializer handle the !php/object type in a safe manner, such as prohibiting the deserialization of types that have destructors defined. If this is not possible, it is recommended that yaml_parse_url be removed and the documentation for the remaining yaml_* functions be updated with warnings akin to that of unserialize().