Insecure Deserialization
Insecure deserialization vulnerabilities occur when applications reconstruct objects from serialized data without proper validation, potentially allowing attackers to execute arbitrary code, bypass authentication, or manipulate application logic. These vulnerabilities affect virtually every major programming language: Java (ObjectInputStream, ysoserial gadget chains), PHP (unserialize), Python (pickle, PyYAML), .NET (BinaryFormatter, Json.NET with TypeNameHandling), and Ruby (Marshal). Deserialization attacks are particularly dangerous because they often achieve remote code execution with a single crafted payload. The exploitation landscape includes gadget chain discovery, polyglot payloads that work across libraries, and attacks against message queues, caching layers, and session management systems that serialize user-controlled data. Defenses include avoiding native serialization for untrusted data, using safe alternatives like JSON, implementing allowlists for deserialized types, and integrity checking serialized objects.
| Date Added | Link | Excerpt |
|---|
Frequently Asked Questions
- What makes deserialization vulnerabilities so dangerous?
- Deserialization vulnerabilities often lead directly to remote code execution (RCE) because the deserialization process can trigger arbitrary method calls through gadget chains — sequences of existing classes whose methods chain together to execute attacker-controlled commands. A single crafted payload can compromise an entire server.
- What is a gadget chain?
- A gadget chain is a sequence of existing classes and methods in an application's classpath that, when triggered during deserialization, produce a dangerous side effect like code execution. Tools like ysoserial (Java), phpggc (PHP), and peas (Python) generate payloads for known gadget chains in popular libraries and frameworks.
- How do you prevent insecure deserialization?
- Never deserialize untrusted data using native serialization formats (Java ObjectInputStream, Python pickle, PHP unserialize). Use safe data formats like JSON for data exchange. If native serialization is required, implement strict type allowlists, integrity checks (HMAC signatures), and consider using look-ahead deserialization that validates types before instantiation.