Insecure Deserialization

HighNetwork & InfrastructureA08:2021 – Software and Data Integrity Failures

Deserialization of untrusted data leads to remote code execution, authentication bypass, privilege escalation, or replay attacks when object graphs are reconstructed without validation.

Immediate Response

1Immediately block or sandbox the affected deserialization endpoint.
2Isolate any systems showing signs of post-exploitation activity.
3Rotate all secrets and credentials accessible from the affected service.

Short-term Remediation

All playbooks

Long-term Prevention

1Run deserialization in a sandboxed environment with restricted permissions.
2Include deserialization-specific SAST rules in your CI/CD pipeline.
3Conduct regular security reviews of all code paths that accept serialized data.
4Monitor for deserialization gadget chain indicators using RASP or EDR tools.

Attack vectors

Deserializing user-controlled cookies, JWT payloads, or API request bodies
PHP unserialize() called on user input
Java native deserialization of untrusted streams
Python pickle.loads() on attacker-supplied data

Indicators of compromise

Unexpected class instantiation or method invocations in application logs
Serialized object patterns (e.g., `rO0AB` for Java base64, `O:` for PHP) in request parameters
Unusual process spawning from application server processes

Tooling

ysoserial (authorized)OWASP ZAPSemgrepSnyk