# Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerce

WooCommerce CSV importer passes user-controlled file path to fopen, enabling phar:// deserialization and PHP code execution for Shop managers.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: simonscannell
- Disclosed: 2019-12-19
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/403083
- Library page: https://bugbountylibrary.com/r/h1%3A403083
- Tags: area:web domain:web impact:privesc impact:rce kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:deserialization vuln:rce

**Target:** WooCommerce product CSV importer (class-wc-product-csv-importer.php)
**Root cause:** The importer constructor calls read_file() which calls fopen($this->file) on an attacker-controlled file parameter without validating it is a real CSV, allowing a phar:// wrapper to trigger PHP object deserialization.
**Steps:**
1. Upload a crafted phar payload disguised as poc.jpg via the media uploader (extension irrelevant).
2. Start a product import with a valid CSV file.
3. Confirm the import prompt and intercept the POST request.
4. Modify the file parameter to the `phar://` wrapper pointing at the uploaded poc.jpg.
5. Submit; fopen triggers phar deserialization and PHP code executes.
**How found:** Applied the known PHP phar deserialization technique (RIPS blog) to the WooCommerce importer after noticing fopen is called on an unvalidated user-supplied file path.
**Exploitation:** Attacker with Shop manager role uploads a phar payload as an image, then during CSV import confirmation tampers the file POST parameter to a phar:// path, causing fopen to deserialize the phar metadata and execute arbitrary PHP, leading to full WordPress/server compromise.
**Escalation:** Shop manager (limited role) escalates to full server takeover via arbitrary PHP execution.
**Insight:** Any user-controlled path reaching fopen/file functions in PHP is a phar deserialization sink; look for importers/uploaders where a file path parameter is passed to filesystem functions without extension or scheme validation.