Understanding Insecure Deserialisation

Insecure deserialization is a critical cybersecurity vulnerability that occurs when applications blindly trust serialized data without proper validation. This oversight allows attackers to manipulate data during the deserialization process, potentially leading to remote code execution, privilege escalation, or denial-of-service attacks. Understanding this vulnerability is essential for both developers and security professionals to prevent exploitation.

---

Key Concepts

What Is Serialization?

Serialization converts an object's state into a storable or transmittable format (e.g., JSON, XML, or binary). This process enables data persistence, inter-process communication, or API interactions.

What Is Deserialization?

Deserialization reconstructs the serialized data back into an object. If the data is tampered with, malicious payloads can execute during this process.

Critical Risk: Insecure deserialization ranks among the OWASP Top 10 vulnerabilities due to its potential for severe impact.

---

How Insecure Deserialization Works

The Attack Flow

1. Input Injection: An attacker crafts malicious serialized data (e.g., via user input, cookies, or API requests).
2. Deserialization: The application processes the data without validation.
3. Exploitation: Malicious payloads execute, leading to:
   • Remote code execution (RCE)
   • Authentication bypass
   • Data tampering

Common Attack Vectors

• Cookies/Session Data: Serialized session objects stored client-side.
• API Requests: Untrusted data in JSON/XML payloads.
• File Uploads: Malicious files disguised as serialized data.

---

Real-World Exploits

Vulnerability	CVE ID	Impact	Mitigation Example
Log4j RCE	CVE-2021-44228	Arbitrary code execution via JNDI lookups in serialized data.	Disable JNDI lookups; update Log4j.
WebLogic RCE	CVE-2015-4852	Attackers exploited Java deserialization to execute commands.	Patch WebLogic; use whitelisting.
Jenkins Deserialization Flaw	CVE-2016-0792	Remote code execution via crafted serialized objects in HTTP requests.	Update Jenkins; restrict input.

---

Exploitation Techniques

White-Box Testing (Source Code Access)

• Focus Areas:
  • Functions like unserialize() (PHP), ObjectInputStream (Java), or pickle.loads() (Python).
  • User-controlled input passed directly to deserialization functions.
• Example:

  $data = $_GET['user_data']; // Untrusted input
  $object = unserialize($data); // Vulnerable deserialization
  

Black-Box Testing (No Source Code)

• Detection Methods:
  • Error Analysis: Look for unserialize() errors in server responses.
  • Pattern Recognition: Test for base64-encoded data in cookies or headers.
  • File Inclusion: Append ~ to PHP filenames to access backup files.
• Tooling: Use Burp Suite or OWASP ZAP to fuzz serialized payloads.

---

Mitigation Strategies

For Developers

• Avoid Dangerous Formats: Replace pickle (Python), unserialize() (PHP), or Java serialization with JSON/XML.
• Input Validation:
  • Use allowlists to restrict data types/values.
  • Sanitize all user-controlled input before deserialization.
• Secure Libraries:
  • Use json.loads() (Python) or JSON.parse() (JavaScript) instead of native deserialization.
  • For Java, employ ObjectInputFilter to restrict classes.
• Code Examples:

  # Safe: JSON deserialization
  import json
  data = json.loads(user_input)  # Validates structure
  

For Security Teams

• Static Analysis: Scan codebases for unserialize(), pickle, or ObjectInputStream.
• Dynamic Testing: Fuzz applications with malformed serialized data.
• Runtime Protections:
  • Deploy Web Application Firewalls (WAFs) with deserialization rules.
  • Monitor for unusual deserialization errors in logs.

---

Best Practices Checklist

• Replace native serialization with JSON/XML where possible.
• Validate and sanitize all serialized data before processing.
• Use digital signatures to verify data integrity.
• Restrict deserialization to trusted classes (e.g., Java’s ObjectInputFilter).
• Log and monitor deserialization attempts for anomalies.

---

Learn More

• OWASP Resources:
  • Deserialization Cheat Sheet
  • OWASP Top 10: Insecure Deserialization
• CWE Details:
  • CWE-502: Deserialization of Untrusted Data
• Tools:
  • ysoserial (Java deserialization payload generator)
  • PHPGGC (PHP deserialization gadget chains)