📋 What Is It?
Insecure Deserialization - Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks.
#8
OWASP Rank 2017
2%
Apps Tested
33K
Occurrences
⚠️ Common Exploits
- Remote Code Execution: Execute arbitrary code
- Replay Attacks: Replay serialized objects
- Privilege Escalation: Modify object properties
- Injection Attacks: Inject malicious data
- Authentication Bypass: Manipulate auth tokens
🔴 Attack Flow
1. Attacker intercepts serialized object
↓
2. Modifies object to include malicious code
↓
3. Sends modified object to application
↓
4. Application deserializes without validation
↓
5. BREACH: Remote code execution achieved!
↓
2. Modifies object to include malicious code
↓
3. Sends modified object to application
↓
4. Application deserializes without validation
↓
5. BREACH: Remote code execution achieved!
✓ Prevention Checklist
- Avoid deserialization of untrusted data
- Implement integrity checks (digital signatures)
- Isolate code that deserializes in low privilege environments
- Log deserialization exceptions and failures
- Use data-only formats like JSON
📌 Quick Reference
Risk Level: HIGH RISK
Year: OWASP Top 10 2017
Category: WEB
Ranking: #8 in 2017