insecure-deserialization

Insecure Deserialization (OWASP A08)

Prevent remote code execution and object injection through safe deserialization practices.

When to Use

• Parsing serialized objects from untrusted sources
• Handling session data or cookies
• Processing API payloads with type information
• Working with message queues
• Importing/exporting data

Risk Levels by Language

Language	Serialization	Risk	Impact
Java	ObjectInputStream	CRITICAL	RCE
Python	pickle/marshal	CRITICAL	RCE
PHP	unserialize()	CRITICAL	RCE
Ruby	Marshal.load	CRITICAL	RCE
Node.js	node-serialize	HIGH	RCE
.NET	BinaryFormatter	CRITICAL	RCE
JavaScript	JSON.parse	LOW	Prototype pollution

Vulnerable Patterns

Python

# VULNERABLE - pickle with untrusted data
import pickle
data = pickle.loads(user_input)  # RCE possible!

# VULNERABLE - yaml.load without SafeLoader
import yaml
data = yaml.load(user_input)  # RCE possible!

# VULNERABLE - marshal
import marshal
data = marshal.loads(user_input)

Java

// VULNERABLE - ObjectInputStream with untrusted data
ObjectInputStream ois = new ObjectInputStream(inputStream);
Object obj = ois.readObject();  // RCE possible!

// VULNERABLE - XMLDecoder
XMLDecoder decoder = new XMLDecoder(inputStream);
Object obj = decoder.readObject();

PHP

// VULNERABLE - unserialize with user input
$data = unserialize($_POST['data']);  // RCE possible!

// VULNERABLE - unserialize from cookie
$session = unserialize($_COOKIE['session']);

Node.js

// VULNERABLE - node-serialize
const serialize = require('node-serialize');
const obj = serialize.unserialize(userInput);  // RCE possible!

// VULNERABLE - js-yaml without safe loading
const yaml = require('js-yaml');
const data = yaml.load(userInput);  // Code execution possible!

// VULNERABLE - prototype pollution via JSON
const obj = JSON.parse('{"__proto__": {"admin": true}}');