Insecure Deserialization

Summary

Insecure deserialization is a security vulnerability that occurs when untrusted data is deserialized by an application, allowing attackers to manipulate serialized objects to execute arbitrary code, escalate privileges, or cause denial of service.

Key Characteristics

• Exploitation involves tampering with serialized objects before they are deserialized by the application.
• Can lead to remote code execution, data tampering, or application crashes.
• Often arises in applications that accept serialized objects from untrusted sources without proper validation.
• Common in languages and frameworks that support object serialization, such as Java, PHP, and .NET.
• Hard to detect due to complex object graphs and custom serialization mechanisms.

Defensive Controls

• Implement strict input validation and integrity checks on serialized data before deserialization.
• Use allowlists to restrict deserialization to only trusted classes or types.
• Avoid deserializing data from untrusted or unauthenticated sources.
• Employ serialization libraries that provide built-in security features or safer alternatives.
• Apply runtime protections such as sandboxing and monitoring for anomalous deserialization behavior.

Related Security Solutions

Web Application Firewalls (WAFs) can help detect and block malicious serialized payloads, while Static Application Security Testing (SAST) tools identify insecure deserialization patterns in code. Runtime Application Self-Protection (RASP) solutions provide real-time monitoring and prevention of deserialization attacks during application execution.