Insecure Deserialization
Deserialization is the return of a packed object into a form the application can use. The problem arises when an application accepts an object from an untrusted source and handles it as though it were safe. At that point the attacker is not sending mere data but a specially prepared structure that can change the flow of execution.
Term
description · examples · notesDeserialization is the return of a packed object into a form the application can use. The problem arises when an application accepts an object from an untrusted source and handles it as though it were safe. At that point the attacker is not sending mere data but a specially prepared structure that can change the flow of execution.
Description
In the worst cases insecure deserialization leads to remote code execution. In milder but still serious cases it can change a user's role, crash a service, bypass the application's logic, or open access to data that was never meant to be reachable.
This class of vulnerability is awkward because it often demands good knowledge of the internal workings of the application, the framework and the libraries. Once the attacker finds a suitable chain of objects, the application itself does the work it should never have done.
Examples
- An application accepts a serialized object from a cookie and determines the user's role from it.
- A specially prepared Java object triggers a chain of calls that ends with a command executed on the server.
- A vulnerable library for handling XML or binary objects lets an attacker cause RCE.
Notes
- An untrusted serialized object is not ordinary input. It is potentially malicious behavior in a package.
- If deserialization cannot be avoided, objects have to be signed, strictly validated and handled in a restricted context.
Mentioned in the news
Techniques
carried out with 2Techniques used to carry it out. Select one to open its page.
Defenses
countered by 4How it is defended against. Select one to open its page.