Understanding Deserialization Vulnerabilities: How They Happen and Why They Matter

In today’s software landscape, deserialization vulnerabilities present a significant security risk. Deserialization is the process of reconstructing an object from a byte stream, often used to transfer data between different parts of an application or different applications altogether. However, if an attacker can manipulate the serialized data, they can exploit the deserialization process to execute arbitrary code or gain unauthorized access to sensitive information. This article explores how deserialization vulnerabilities occur and why they are a critical concern for developers and security professionals alike.

The attacker would create a malicious person.ser file with the intent that your deserialization code will read it. Here’s a more detailed explanation of how this attack scenario might unfold:

Attack Scenario

1. Crafting the Malicious Serialized File: The attacker creates a malicious person.ser file by serializing a Person object with properties that will trigger the execution of malicious code upon deserialization.
2. Placing the Malicious File: The attacker somehow places this malicious person.ser file in a location where your application will read it. This could happen in several ways:
   • The file could be uploaded through a web interface if your application allows file uploads.
   • The attacker might exploit another vulnerability in your application to place the file on the filesystem.
   • The attacker could gain access to the filesystem through other means (e.g., exploiting a different service or using credentials).
3. Deserialization: When your application reads and deserializes the person.ser file, the deserialization process triggers the execution of the malicious code embedded within the serialized data.

Example Step-by-Step

Step 1: Crafting the Malicious Serialized File

import java.io.FileOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;

public class SerializeMaliciousPerson {
    public static void main(String[] args) {
        Person maliciousPerson = new Person("trigger");

        try (FileOutputStream fileOut = new FileOutputStream("person.ser");
             ObjectOutputStream out = new ObjectOutputStream(fileOut)) {
             
            out.writeObject(maliciousPerson);
            System.out.println("Serialized malicious Person object");
        } catch (IOException i) {
            i.printStackTrace();
        }
    }
}

This code creates a Person object with the name “trigger” and serializes it to person.ser.

Step 2: Placing the Malicious File

For this scenario, let’s assume the attacker has found a way to place person.ser in a directory where your deserialization code will read from. This could be, for example, an upload directory if your application reads files from user uploads.

Step 3: Deserialization and Exploitation

When your deserialization code reads the person.ser file, it will trigger the malicious code:

import java.io.FileInputStream;
import java.io.IOException;
import java.io.ObjectInputStream;

public class DeserializePerson {
    public static void main(String[] args) {
        try (FileInputStream fileIn = new FileInputStream("person.ser");
             ObjectInputStream in = new ObjectInputStream(fileIn)) {
             
            // Deserialize the object
            Person person = (Person) in.readObject();
            System.out.println("Deserialized Person: " + person);
        } catch (IOException | ClassNotFoundException e) {
            e.printStackTrace();
        }
    }
}

Since the Person class’s readObject method contains code that checks for the name “trigger” and then calls executeMaliciousCode, the deserialization of this crafted object will execute the malicious method:

private void readObject(ObjectInputStream ois) throws IOException, ClassNotFoundException {
    ois.defaultReadObject();
    // Example of vulnerable code
    if (name.equals("trigger")) {
        executeMaliciousCode();
    }
}

private void executeMaliciousCode() {
    System.out.println("Executing malicious code...");
    // Malicious actions could be performed here
}

In the provided example, the executeMaliciousCode method is part of the Person class and thus written by the developer, not the attacker. However, a deserialization attack typically leverages existing code in the application or dependencies that can be manipulated to perform harmful actions