Insecure Deserialization

What is Deserialization?

Insecure deserialization occurs when applications deserialize data from untrusted sources without validation, allowing attackers to manipulate serialized objects.

How it works

An attacker modifies serialized objects (Java, PHP, Python, .NET) to include malicious payloads. When the application deserializes this data, it executes the attacker's code or alters application logic.

Impact

Remote code execution, privilege escalation, injection attacks, replay attacks, and denial of service.

How to fix it

Never deserialize untrusted data. Use simple data formats like JSON. Implement integrity checks (digital signatures) on serialized objects. Monitor deserialization exceptions.

Tags