Insecure Deserialization

Description

Insecure deserialization occurs when an application deserializes a user-supplied object string without properly verifying its integrity. This vulnerability enables attackers to manipulate the system state and potentially execute remote commands, leading to serious security breaches.

Recommendation

To mitigate the risk of insecure deserialization:

• Reconsider the application architecture to minimize reliance on deserialization of objects from untrusted sources.
• If deserialization from untrusted sources is unavoidable, ensure that only primitive data types are accepted, and implement strict integrity checks such as digital signatures on serialized objects to prevent data tampering.
• Log all deserialization errors and actively monitor them for any suspicious activities or attempts at exploitation.

References

• CWE-502
• OWASP 2021-A8
• OWASP: Deserialization Cheat Sheet