Insecure Deserialization
Untrusted data deserialized by an app can become an injection vector: how insecure deserialization leads to arbitrary code execution or bypasses.
Quick Answer
Deserialization of untrusted data is dangerous because attacker-controlled fields map onto objects; mitigate with signed/allow-listed formats, type allow-lists, don't deserialize untrusted input, and strict validation.
Definition
Insecure deserialization is the unsafe reconstruction of untrusted data, which can let an attacker control object state and achieve arbitrary code execution or logic bypasses.
What it is
Deserialization reconstructs objects from serialized data (Java/PHP/Python/.NET). When that data is untrusted and the deserializer is permissive, an attacker can craft bytes that create attacker-chosen objects — leading to RCE or access-control/logic bypass.
Why it matters
Exploits are frequently achieved with a single crafted request and no authentication, and they bypass ordinary input validation because the payload is “valid data”. These make for high-impact, quietly critical failures.
How it works
- Java/.NET/PHP “gadget” chains: a serialized object that triggers a dangerous method on reconstruction.
- Language/format confusion: JSON with embedded native object syntax.
- Signature/typing bypasses: guessed types or accepted polymorphic names.
Detection
- Request bodies that are native-serialized blobs (base64 of Java/PHP serialized data).
- Anomalous class/type names in JSON payloads.
- Known CVE gadgets for the runtime in use.
Mitigation
- Do not deserialize untrusted input; if required, use a strict allow-list of types.
- Prefer safe formats (structured JSON/Protobuf) with schema validation over native serialization.
- Require integrity (HMAC/signature) when deserialization is unavoidable; keep runtimes patched (see
guides:tool-cve-guide).
Investigation
Reproduce the crafted blob, confirm the reachable gadget/CVE in the runtime, scope affected services from logs, and patch or switch to a safe serializer.
References
Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.