Insecure Deserialization
A vulnerability that allows attackers to manipulate serialized data to execute code.
Understanding Insecure deserialization
Insecure deserialization is a vulnerability that occurs when an application deserializes untrusted or manipulated data, leading to remote code execution (RCE), privilege escalation, or denial-of-service (DoS) attacks. Attackers exploit this flaw by injecting malicious serialized objects, which the application processes without proper validation. This vulnerability is commonly seen in Java, .NET, PHP, and Python applications that use object serialization.
Common Applications and Use Cases
Web Applications and APIs – Attackers exploit insecure deserialization in web apps that use JSON, XML, or binary serialization formats.
Session Management Exploits – Manipulating serialized session tokens to gain unauthorized access.
Server-Side Application Attacks – Injecting malicious payloads into serialized objects to execute arbitrary code.
Denial-of-Service (DoS) Attacks – Causing excessive resource consumption by sending manipulated serialized data.
Best Practices and Security Considerations
Avoid Deserializing Untrusted Data – Reject input from unverified sources to prevent malicious object injection.
Use Allow Lists for Acceptable Object Types – Restrict deserialization to known and safe object classes.
Implement Integrity Checks – Use digital signatures or hashes to verify serialized data authenticity.
Use JSON or XML Safely – Disable features that allow automatic deserialization of arbitrary data.
Perform Security Testing – Use tools like Burp Suite, OWASP ZAP, and SAST/DAST scanners to detect deserialization flaws.