Insecure Deserialization
Insecure deserialization turns serialized objects into live code and state: gadget chains in the language runtime convert crafted payloads into remote code execution or logic abuse.
Definition
Deserializing untrusted data reconstructs objects with arbitrary types and populated fields. Language runtimes with rich object systems — Java, .NET, PHP, Python pickle — allow attacker-chosen classes whose constructors and setters execute during reconstruction, forming gadget chains. Impact ranges from DoS to full RCE, and integrity of the reconstructed graph is unverified.
Context and scope
Found in caches, message queues, session stores, RPC protocols, and cookies carrying serialized blobs. The historic Java commons-collections chains made this a headline class.
Common misconceptions
- Signing the blob makes it safe — signatures protect integrity against outsiders; compromised or shared keys and insider blobs still deserialize into gadgets
- Only Java is affected — Python pickle, PHP object injection, .NET BinaryFormatter, and YAML tags all execute during load
- JSON serialization has the same risk — plain JSON reconstructs plain data; the danger begins with typed object graphs and tag-driven instantiation
Anti-patterns
- Storing framework-serialized session objects in client cookies or unauthenticated caches
- Accepting pickle or BinaryFormatter payloads from any authenticated internal endpoint as trusted
- Replacing binary formats with YAML that permits arbitrary tags, recreating the same execution sink
Related concepts
Related examples
Authoritative source
https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data
What it is
Serialization flattens live objects; deserialization rebuilds them, invoking constructors, property setters, and custom hooks. When the byte stream is attacker-influenced, the attacker chooses which classes come alive and with what state — and class libraries full of useful side effects become gadget catalogs.
How it works
A payload names classes whose instantiation performs work: writing files, spawning processes, or altering static state. Chained gadgets compose these into arbitrary execution. Detection is hard because the blob is opaque; prevention is using data-only formats — JSON without type tags — or signed and versioned envelopes with strict schema validation.
When to eliminate
Anywhere serialized objects cross a trust boundary: sessions, cache entries, queue messages, RPC bodies. Migrate to explicit DTOs with schema validation, and keep object-graph serializers strictly inside one process.
Pitfalls
Runtime hardening — look-ahead deserialization filters in Java — reduces reachable classes but needs maintenance as dependencies evolve. Compression and encryption of blobs hide the content from reviewers without removing the gadget risk. Document every remaining serializer and monitor for unexpected class names in telemetry.