Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #deserialization

5 posts

All topics Clear tag filter

Files, objects & APIsOverview (os.system, ("id",))

Insecure Deserialization3 min read

Insecure Deserialization: How a Serialized Blob Becomes Remote Code Execution

When an application rebuilds objects from untrusted serialized data, attacker-crafted gadget chains can run code during deserialization itself. Here is how object injection leads to RCE, and why data-only formats are the fix.

Files, objects & APIs O:4:"User":1:{s:4:"name";...}

Insecure Deserialization5 min read

PHP Object Injection: unserialize() and the Magic-Method Chain

Calling unserialize() on attacker-controlled input instantiates arbitrary classes and fires their magic methods automatically. Here is how a POP gadget chain rides __wakeup and __destruct to a dangerous sink, and why json_decode is the fix.

Files, objects & APIs !!python/object/apply:os.system

Insecure Deserialization4 min read

Python Deserialization: pickle, PyYAML and the reduce Trap

pickle.loads on untrusted bytes runs code because __reduce__ returns a callable that executes at load time, and yaml.load without SafeLoader builds arbitrary objects. Here is the minimal exploit, and why safe_load and JSON are the fix.

Files, objects & APIs {"$type":"ObjectDataProvider"}

Insecure Deserialization4 min read

.NET Deserialization: BinaryFormatter, Json.NET and TypeNameHandling

On .NET, the type information lives inside the payload. BinaryFormatter and a Json.NET $type directive will happily instantiate whatever class an attacker names — including gadgets that reach a process start. Here is how it leads to RCE, and the binder allowlist that stops it.

Files, objects & APIs rO0ABXNyABZqYXZhLnV0aWw

Insecure Deserialization4 min read

Java Deserialization: ObjectInputStream and the Gadget-Chain Problem

Calling ObjectInputStream.readObject() on bytes an attacker controls is enough to reach Runtime.exec during deserialization itself. Here is why a gadget chain runs even though your code never expected that type, and how look-ahead filtering shuts it down.

Understand the bug. See the exploit. Ship the fix.

Posts tagged #deserialization

Insecure Deserialization: How a Serialized Blob Becomes Remote Code Execution

PHP Object Injection: unserialize() and the Magic-Method Chain

Python Deserialization: pickle, PyYAML and the __reduce__ Trap

.NET Deserialization: BinaryFormatter, Json.NET and TypeNameHandling

Java Deserialization: ObjectInputStream and the Gadget-Chain Problem

Python Deserialization: pickle, PyYAML and the reduce Trap