security vulnerability_error ai_generated true

ObjectInputStream: deserialization of untrusted data

ID: security/deserialization-attack

Also available as: JSON · Markdown
80%Fix Rate
84%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Untrusted data deserialized leading to RCE risk.

generic

Workarounds

  1. 92% success Use safe serialization format: JSON instead of pickle/Java serialization
  2. 88% success Implement allowlist of permitted classes for deserialization

Dead Ends

Common approaches that don't work:

  1. Add input validation after deserialization 90% fail

    Code already executed during deserialization

  2. Use blocklist for dangerous classes 78% fail

    Attackers find new gadget chains