Analysis Report · Folder Analysis cache/live-composer-page-builder_2.0.2 → cache/live-composer-page-builder_2.0.3 — CVE-2025-14071

Vulnerability Existed: yes
TRUE POSITIVE
Insecure Deserialization - CWE-502 - modules/posts/module.php - Lines 5620-5625 (Old Code)

Old Code:
```php
// Uncode module options passed as serialized content.
$data = @unserialize( $content );

if ( $data !== false ) {
    $options = unserialize( $content );
} else {
    $fixed_data = preg_replace_callback( '!s:(\d+):"(.*?)";!', function( $match ) {
        return ( $match[1] == strlen( $match[2] ) ) ? $match[0] : 's:' . strlen( $match[2] ) . ':"' . $match[2] . '";';
    }, $content );
    $options = unserialize( $fixed_data );
}
```

Fixed Code:
```php
// 1. Try JSON DECODING (New, secure format)
$options = json_decode( $content, true );

// 2. Fallback to PHP unserialize if JSON fails
// This handles all existing content saved in the serialized format.
if ( ! is_array( $options ) ) {

    // Define the secure unserialize arguments based on PHP version.
    $unserialize_args = ( version_compare( PHP_VERSION, '7.0.0', '>=' ) )
        ? array( 'allowed_classes' => false ) // Secure on PHP 7.0+
        : null; // Allows object injection on older PHP, but this is the necessary trade-off for legacy data loading.
                // For maximum security, you should deprecate support for PHP < 7.0.

    // Try standard unserialize with object injection blocked
    $options = @unserialize( $content, $unserialize_args );

    // Fallback for broken serialization string length (from original code)
    if ( $options === false ) {
        $fixed_data = preg_replace_callback( '!s:(\d+):"(.*?)";!', function( $match ) {
            return ( $match[1] == strlen( $match[2] ) ) ? $match[0] : 's:' . strlen( $match[2] ) . ':"' . $match[2] . '";';
        }, $content );
        // Try to unserialize the fixed string, still blocking objects
        $options = @unserialize( $fixed_data, $unserialize_args );
    }
}

// 3. Final Validation
if ( ! is_array( $options ) ) {
    // Data is invalid or failed to deserialize securely.
    return '';
}

// Optional: Validate that required keys exist (as suggested in the third developer solution)
$required_keys = array( 'post_type', 'amount', 'pagination_type' );
foreach ( $required_keys as $key ) {
    if ( ! isset( $options[ $key ] ) ) {
        return '';
    }
}

// Use the now-validated $options array for the rest of the module logic
$opts = $options;
```

Explanation:
The original code used PHP's `unserialize()` function without any security restrictions, which is vulnerable to PHP Object Injection attacks (CWE-502). An attacker could craft malicious serialized data containing gadget chains to execute arbitrary code on the server. The fix addresses this in multiple ways:

1. **Primary Fix - JSON Encoding**: The module now uses `json_encode()` instead of `serialize()` for new data (line 5615), which is inherently safer as JSON cannot execute arbitrary PHP objects.

2. **Secure Deserialization**: When falling back to `unserialize()` for legacy data, the fix now uses the `allowed_classes` parameter (PHP 7.0+) set to `false`, which prevents object instantiation during unserialization, eliminating object injection vectors.

3. **Input Validation**: Additional validation checks ensure the deserialized data is an array and contains required keys before use, preventing use of corrupted or malicious data.

4. **Explicit Failure Handling**: The code now explicitly returns an empty string if deserialization fails or produces invalid data, rather than proceeding with potentially dangerous data.

This is a proper fix for insecure deserialization that maintains backward compatibility with legacy serialized data while securing the codebase for new data going forward.