Vulnerability field guide
Insecure Deserialization
When an application rebuilds objects from untrusted serialized data, attacker-crafted gadget chains can run code during deserialization itself. Here is how object injection leads to RCE, and why data-only formats are the fix.
5 articles20 min totalOverview to advanced techniques
Start here
(os.system, ("id",))Step 01 · Start with the overview
Insecure Deserialization3 min read
Insecure Deserialization: How a Serialized Blob Becomes Remote Code Execution
When an application rebuilds objects from untrusted serialized data, attacker-crafted gadget chains can run code during deserialization itself. Here is how object injection leads to RCE, and why data-only formats are the fix.
Read the overviewContinue the field guide
4 focused deep-divesInsecure Deserialization techniques
- 02.NET.NET Deserialization: BinaryFormatter, Json.NET and TypeNameHandling4 min
- 03JavaJava Deserialization: ObjectInputStream and the Gadget-Chain Problem4 min
- 04PHPPHP Object Injection: unserialize() and the Magic-Method Chain5 min
- 05PythonPython Deserialization: pickle, PyYAML and the __reduce__ Trap4 min