Insecure Deserialization: How a Simple Data Conversion Can Let Hackers Take Over Your App

Each modern web application depends on the serialization - convert items into a stream of bytes for storage or transmission - and deserialization - the reverse process of converting that data back into use to use items. But when this deserialization is unsafe, it can open the door to the remote code execution (RCE), data tampering, enhancement, or even complete system compromise.

In this post, we will break as to what is really unsafe Deserialization, its origin, how hackers exploit it, how you can find out, and most importantly - how to stop it. Whether you are a software developer, penetration examiner, or cyber security students, it should be a address that the top 10 vulnerability.

🕰 History of unsafe deserialization attacks

🏗 serialization basics:

• The serialization allows data structures (objects) to write files, transmit on network, or store into memory, which stores as a bite stream.
• Deserialization reverses it - converting the bite stream back into an usable object.

📆 timeline:

• In the early 2000s: Java and .NET introduced the object serialization mechanism for easy network communication and data firmness.
• 2015-Wake-up call: Security researcher Chris Foff demonstrated distant code execution through disorganization weaknesses in the Apache Commons Collection.
• 2017 - Owasp recognizes this: "unprotected deserialization" became part of Owasp Top 10 (A8: 2017).
• 2020s - still dangerous: Despite increased awareness, many structures still use unsafe or heritage order methods (eg, Java, PHP, Python's pickle, ruby martial).

🔍 What is unprotected deserialization?

When is unprotected deserialization:

1. The incredible data is deserialized without proper verification or integrity investigation.
2. The attacker sends crafted objects that execute malicious code.

💣 Why it is dangerous:

• Can lead to Remote Code Execution (RCE).
• Can allow to increase privilege, data tampering, or refusal to serve.
• It is difficult to detect and test as the payloads are often deeply embedded.

🧪 How Insecure Deserialization Works

🔧 Example: Java

Let’s say your application accepts serialized Java objects via an API and deserializes them using ObjectInputStream. If the app doesn’t check the object type or data source, an attacker could send a crafted Java object that executes a payload during deserialization.

java

ObjectInputStream in = new ObjectInputStream(request.getInputStream());

Object obj = in.readObject();  // dangerous if data is untrusted

If the attacker includes an object that calls Runtime.getRuntime().exec("malicious command"), the code will be executed on your server — before any application logic runs.

🧠 Common Vulnerable Serialization Formats

• Java Serialized Objects
• PHP unserialize()
• Python pickle.loads()
• Ruby Marshal.load()
• .NET BinaryFormatter

Any format that allows object graphs and supports method invocation can be dangerous if misused.

🕵️‍♂️ How to Detect Insecure Deserialization

Detection is tricky because:

• Payloads are often embedded.
• Traffic appears normal.
• Deserialization happens silently in the backend.

🔍 Indicators:

• Application crashes on malformed data inputs.
• Unexpected behavior when providing large, complex inputs.
• Unusual exceptions like InvalidClassException, ClassCastException, StreamCorruptedException.

⚒️ Tools & Techniques:

1. Static Code Analysis

• Look for dangerous functions: unserialize(), readObject(), pickle.loads(), Marshal.load().
• Review deserialization logic for type validation and access control.

2. Fuzzing & Payload Injection

• Use tools like:
• ysoserial (Java)
• PHPGGC (PHP)
• dotnet/ysoserial.net (.NET)

3. Dynamic Testing

• Modify serialized data in transit using tools like Burp Suite.
• Replay requests with modified serialized objects.

4. Logs and Stack Traces

• Look for deserialization exceptions and object stream errors.

💣 How hackers exploit unsafe unsafeness

Step-by-step example:

1. Find an input that accepts serial data (eg, session cookies, hidden form fields, API payloads).
2. Craft a malicious sequential object using devices such as ysoserial.
3. Send the payload to the server.
4. The server deserial the object and executes the attacker's code.

General exploitation:

• Remote Code Performance (RCE):

Execute system commands such as WGET, Curl, or Powershell script.

• Read/write arbitrary file:

Inject serial items that manipulate file currents.

• privilege escalation:

Inject the administrator-level items in the session tokens.

🚨 Insecure vulnerability of real world

1. Apache Commons Collections (2015)

• The Java library vulnerability readObject() and exploited through the square loading chain.
• Many Java led to wide RCE on platforms.

2. Velogic (cve-2020-2555)

• The vulnerability in the relevant component to the ingredient vabelogic server vulnerability allowed the execution of distance code.

3. Ruby on Rail (CVE-2013-0156)

• JSON Parser Demonstration allowed deserialization in Yaml.Lad, which led to RCE.

4. Magento (CVE-2016-4010)

• PHP unserialize() function is used on incredible user inputs, causing RCE to Magento E-Commerce platforms.

🔐 How to Prevent Insecure Deserialization

✅ 1. Avoid Native Serialization

• Use JSON or XML for object transmission.
• These formats don’t support code execution.

✅ 2. Use Whitelisting

• Allow only known safe classes for deserialization.
• Reject anything unexpected or unknown.

✅ 3. Implement Integrity Checks

• Sign or encrypt serialized data (e.g., using HMAC).
• Ensure it hasn’t been tampered with.

✅ 4. Run Deserialization Code in a Sandbox

• Limit file system access, network access, and system calls for deserialization operations.

✅ 5. Keep Libraries Updated

• Vulnerabilities often lie in third-party libraries like Apache Commons, Fastjson, or Kryo.
• Regularly patch and audit these libraries.

✅ 6. Disable Dangerous Functions

• PHP: Disable unserialize() or restrict using allowed_classes parameter.
• Python: Avoid pickle, use json instead.

✅ 7. Use WAF and IDS

• Web Application Firewalls can block known deserialization payloads.
• Intrusion Detection Systems can alert you on unusual behavior patterns.

🧰 Popular Exploitation Tools (For Ethical Testing Only)

⚠️ Disclaimer: Use only in authorized environments for learning or ethical hacking.

• ysoserial (Java payload generator)
• PHPGGC (PHP Generic Gadget Chains)
• Burp Suite Pro (Payload injection and session tampering)
• DotNetSerializerExploit (.NET)

🔚 Conclusion

Unprotected deserialization is a subtle yet severe vulnerability that gives the attackers a previous door in your application internal. This is not just a code-level issue; This is an architectural problem. The key to prevention lies in avoiding unsecured deserialization practices, validing all inputs and using safe ordering formats.

Whether you are creating apps in Java, PHP, Python, or .NET - do not rely on the data made ever. A few rows of unsafe code can mean total system compromise.

🧠 Quick Checklist to Avoid Insecure Deserialization:

✔ Avoid native serialization formats (use JSON/XML)

 ✔ Validate object types before deserialization

 ✔ Implement cryptographic signing of serialized data

 ✔ Use secure coding libraries (updated and audited)

 ✔ Monitor logs for deserialization anomalies

 ✔ Disable dangerous language features like pickle, unserialize, readObject