Security Glossary

Insecure Deserialization

A vulnerability where untrusted data is used to abuse the logic of an application's deserialization process, potentially leading to remote code execution.

Insecure Deserialization occurs when an application deserializes untrusted data without proper validation. Attackers can manipulate serialized objects to achieve denial of service, access control bypass, or remote code execution.

How It Works

// Application receives serialized data
data = request.get("session")

// Deserializes without validation
obj = deserialize(data)  // DANGEROUS!

// Attacker crafts malicious serialized object
// Object's methods execute during deserialization

Impact

  • Remote Code Execution: Via gadget chains
  • Privilege Escalation: Modifying user role in session
  • Data Tampering: Changing prices, quantities
  • DoS: Resource exhaustion during deserialization

Vulnerable Technologies

  • Java: ObjectInputStream, XStream, Jackson
  • PHP: unserialize()
  • Python: pickle, PyYAML
  • Ruby: Marshal.load()
  • .NET: BinaryFormatter, JSON.NET with TypeNameHandling

Prevention

  • Don't deserialize untrusted data
  • Use safe serialization formats (JSON without type handling)
  • Implement integrity checks (HMAC) on serialized data
  • Use allowlists for deserialization classes
  • Keep libraries updated

PentesterLab Exercises

See Also