CVE-2026-29782: OpenSTAManager RCE Vulnerability

CVE-2026-29782 Overview

CVE-2026-29782 is an insecure deserialization vulnerability in OpenSTAManager, an open source management software used for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file contains an unauthenticated endpoint that improperly deserializes attacker-controlled data, potentially enabling remote code execution or other malicious activities.

Critical Impact

Unauthenticated attackers can exploit the insecure deserialization in the OAuth2 flow to potentially execute arbitrary code or manipulate application state by crafting malicious serialized objects.

Affected Products

• OpenSTAManager versions prior to 2.10.2

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-29782 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-29782

Vulnerability Analysis

This vulnerability stems from a classic insecure deserialization pattern (CWE-502) in PHP. The oauth2.php endpoint is configured with $skip_permissions = true, making it publicly accessible without authentication. During the OAuth2 configuration flow, the application retrieves a record from the zz_oauth2 database table using the attacker-controlled state GET parameter, then calls PHP's unserialize() function on the access_token field without any class restriction or type validation.

The lack of class restrictions in the deserialization process is particularly dangerous because it allows an attacker to instantiate arbitrary PHP objects. If gadget chains exist within the application's loaded classes (common in applications using frameworks or libraries), the attacker can leverage these to achieve remote code execution, file operations, or other malicious actions.

Root Cause

The root cause is the unrestricted use of PHP's unserialize() function on user-controllable data without implementing any safe deserialization practices. The oauth2.php file skips permission checks entirely, allowing unauthenticated access, and then deserializes the access_token field from a database record that can be influenced through the attacker-controlled state parameter. This combination of unauthenticated access and unsafe deserialization creates a direct attack path.

Attack Vector

The attack is network-based and can be executed by any remote attacker without authentication. An attacker would craft a malicious HTTP request to the oauth2.php endpoint with a specially crafted state parameter. By manipulating the database record associated with this state value (or if the application allows creation of OAuth2 records), the attacker can inject a malicious serialized PHP object into the access_token field. When the endpoint processes the request and deserializes this field, the malicious object is instantiated.

The exploitation flow typically involves:

1. Identifying or creating a record in the zz_oauth2 table with a known state value
2. Crafting a serialized PHP object payload that leverages available gadget chains
3. Sending a request to oauth2.php with the corresponding state parameter
4. The application deserializes the malicious payload, triggering the gadget chain

For detailed technical information about the vulnerability, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-29782

Indicators of Compromise

• Unusual HTTP requests to /oauth2.php with suspicious or encoded state parameters
• Web server logs showing repeated access to OAuth2 endpoints from unknown sources
• Database queries to the zz_oauth2 table with unexpected or malformed data in access_token fields
• Unexpected PHP object instantiation or class loading in application logs

Detection Strategies

• Monitor web application firewall logs for requests to oauth2.php containing serialized PHP object patterns (e.g., O:, a:, s: prefixes in parameters)
• Implement intrusion detection rules to flag suspicious deserialization patterns in HTTP traffic
• Review database records in zz_oauth2 for anomalous or overly long access_token values that may indicate injection attempts
• Enable PHP error logging to capture failed deserialization attempts or unexpected class loading

Monitoring Recommendations

• Configure centralized logging for all web application access, particularly OAuth2-related endpoints
• Set up alerts for any authenticated or unauthenticated access to oauth2.php from unexpected IP ranges
• Periodically audit the zz_oauth2 database table for suspicious entries
• Deploy endpoint detection and response (EDR) solutions to monitor for post-exploitation activity if the vulnerability is exploited

How to Mitigate CVE-2026-29782

Immediate Actions Required

• Upgrade OpenSTAManager to version 2.10.2 or later immediately
• If immediate upgrade is not possible, restrict access to the oauth2.php endpoint at the web server level
• Review existing records in the zz_oauth2 database table for signs of tampering or malicious content
• Monitor systems for any indicators of compromise related to this vulnerability

Patch Information

The vulnerability has been patched in OpenSTAManager version 2.10.2. The fix is available through the official release:

• GitHub Release Version 2.10.2
• Patch Commit

Organizations should apply this update as soon as possible following standard change management procedures.

Workarounds

• Block or restrict access to oauth2.php using web server configuration (e.g., .htaccess, nginx location blocks) until the patch can be applied
• Implement a web application firewall (WAF) rule to block requests containing serialized PHP object patterns in the state parameter
• If OAuth2 functionality is not required, consider disabling or removing the oauth2.php endpoint entirely
• Apply network segmentation to limit exposure of the OpenSTAManager application to trusted networks only

# Example Apache .htaccess configuration to restrict oauth2.php access
<Files "oauth2.php">
    Require ip 192.168.1.0/24
    # Or deny all access if OAuth2 is not needed:
    # Require all denied
</Files>