Scribd Logo
Upload

Welcome to Scribd!

  • 51 views

    Insecure Deserialization: Description

    Uploaded by

    Glady Gladson
    Insecure deserialization occurs when untrusted data is deserialized, allowing attackers to abuse application logic. It is a top vulnerability that can enable denial of service attacks and remote code execution. Serialization converts objects to a persisted format like JSON or XML for storage or transmission. Deserialization reverses this to reconstruct objects, but untrusted input can introduce vulnerabilities if not validated before deserialization. Attackers can manipulate serialized objects to exploit applications. Mitigations include using open formats like JSON, including integrity checks, ensuring protection tools have full visibility, and preventing remote code execution.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Insecure Deserialization: Description

    Uploaded by

    Glady Gladson
    51 views2 pages
    Insecure deserialization occurs when untrusted data is deserialized, allowing attackers to abuse application logic. It is a top vulnerability that can enable denial of service attacks and remote code execution. Serialization converts objects to a persisted format like JSON or XML for storage or transmission. Deserialization reverses this to reconstruct objects, but untrusted input can introduce vulnerabilities if not validated before deserialization. Attackers can manipulate serialized objects to exploit applications. Mitigations include using open formats like JSON, including integrity checks, ensuring protection tools have full visibility, and preventing remote code execution.

    Original Description:

    Original Title

    INSECURE DESERIALIZATION

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Insecure deserialization occurs when untrusted data is deserialized, allowing attackers to abuse application logic. It is a top vulnerability that can enable denial of service attacks and remote code execution. Serialization converts objects to a persisted format like JSON or XML for storage or transmission. Deserialization reverses this to reconstruct objects, but untrusted input can introduce vulnerabilities if not validated before deserialization. Attackers can manipulate serialized objects to exploit applications. Mitigations include using open formats like JSON, including integrity checks, ensuring protection tools have full visibility, and preventing remote code execution.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    51 views2 pages

    Insecure Deserialization: Description

    Uploaded by

    Glady Gladson
    Insecure deserialization occurs when untrusted data is deserialized, allowing attackers to abuse application logic. It is a top vulnerability that can enable denial of service attacks and remote code execution. Serialization converts objects to a persisted format like JSON or XML for storage or transmission. Deserialization reverses this to reconstruct objects, but untrusted input can introduce vulnerabilities if not validated before deserialization. Attackers can manipulate serialized objects to exploit applications. Mitigations include using open formats like JSON, including integrity checks, ensuring protection tools have full visibility, and preventing remote code execution.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 2

    INSECURE DESERIALIZATION

    Insecure Deserialization is a vulnerability which occurs when untrusted data is used to abuse the
    logic of an application, inflict a denial of service (DoS) attack, or even execute arbitrary code upon it
    being deserialized. It is in the top 10 of OWASP list.

    DESCRIPTION

    Serialization refers to a process of converting an object into a format which can be


    persisted to disk (for example saved to a file or a datastore), sent through streams (for
    example stdout), or sent over a network. The format in which an object is serialized into, can
    either be binary or structured text (for example XML, JSON YAML…). JSON and XML are two
    of the most used serialization formats within web applications.

    Deserialization on the other hand, is the opposite of serialization, that is,


    transforming serialized data coming from a file, stream, or network socket into an object.
    Web applications make use of serialization and deserialization on a regular basis and most
    programming languages even provide native features to serialize data (especially into
    common formats like JSON and XML). It is important to understand that safe deserialization
    of objects is normal practice in software development. The trouble, however, starts when
    deserializing untrusted user input.

    Most programming languages offer the ability to customize deserialization


    processes. Unfortunately, it is frequently possible for an attacker to abuse these
    deserialization features when the application is deserializing untrusted data which the
    attacker controls. Successful insecure deserialization attacks could allow an attacker to carry
    out denial-of-service (DoS) attacks, authentication bypasses and remote code execution
    attacks.

    ATTACK

    Insecure deserialization typically arises because there is a general lack of


    understanding of how dangerous deserializing user-controllable data can be. Ideally, user
    input should never be deserialized at all. However, sometimes website owners think they
    are safe because they implement some form of additional check on the deserialized data.
    This approach is often ineffective because it is virtually impossible to implement validation
    or sanitization to account for every eventuality. These checks are also fundamentally flawed
    as they rely on checking the data after it has been deserialized, which in many cases will be
    too late to prevent the attack.

    Vulnerabilities may also arise because deserialized objects are often assumed to be
    trustworthy. Especially when using languages with a binary serialization format, developers
    might think that users cannot read or manipulate the data effectively. However, while it may
    require more effort, it is just as possible for an attacker to exploit binary serialized objects as
    it is to exploit string-based formats.

    MITIGATION

     Use language-agnostic formats: prefer standard formats such as JSON or YAML


    as opposed to native binary formats.

     Include integrity checks: when possible, include positive validation based on


    signatures for serialized data. Never trust data that has been provided by the
    user.

     Ensure that your protection tool has full visibility: avoid protection based on
    blacklisting or pattern matching (such as WAF and DAST) because it is not
    flexible enough to block unknown threats. RASPs on the other hand enjoy full
    visibility.

     Prevent remote execution: one of the most frequent and pernicious effects of
    Insecure Deserialization is execution of remote code. RASPs wrap your
    application to ensure that no remote execution occurs.

    You might also like