Insecure Deserialization Resources

Frequently Asked Questions

What makes deserialization vulnerabilities so dangerous?

Deserialization vulnerabilities often lead directly to remote code execution (RCE) because the deserialization process can trigger arbitrary method calls through gadget chains — sequences of existing classes whose methods chain together to execute attacker-controlled commands. A single crafted payload can compromise an entire server.

What is a gadget chain?

A gadget chain is a sequence of existing classes and methods in an application's classpath that, when triggered during deserialization, produce a dangerous side effect like code execution. Tools like ysoserial (Java), phpggc (PHP), and peas (Python) generate payloads for known gadget chains in popular libraries and frameworks.

How do you prevent insecure deserialization?

Never deserialize untrusted data using native serialization formats (Java ObjectInputStream, Python pickle, PHP unserialize). Use safe data formats like JSON for data exchange. If native serialization is required, implement strict type allowlists, integrity checks (HMAC signatures), and consider using look-ahead deserialization that validates types before instantiation.