Insecure Deserialization: Remote Code Execution Through Object Manipulation

Insecure deserialization occurs when an application reconstructs objects from untrusted data without proper validation. An attacker crafts a malicious serialized payload that, when deserialized, triggers arbitrary code execution, privilege escalation, or denial of service.

Mapped to CWE-502 and classified under OWASP A08:2021 – Software and Data Integrity Failures, insecure deserialization is one of the most severe vulnerability classes because it frequently leads directly to remote code execution (RCE).

Java and Python are the most affected languages due to their native serialization mechanisms (ObjectInputStream and pickle), which can instantiate arbitrary classes and execute code during the deserialization process.

Java

Java's ObjectInputStream.readObject() restores objects by calling class-specific methods. Attackers chain classes on the classpath ("gadget chains") to reach code execution:

// VULNERABLE: deserializing untrusted data
ObjectInputStream ois = new ObjectInputStream(
  new ByteArrayInputStream(userInput)
);
Object obj = ois.readObject(); // Arbitrary code execution

Libraries like Apache Commons Collections, Spring, and Hibernate contain gadget classes that attackers chain together. Tools like ysoserial automate gadget chain generation.

Python

Python's pickle module can execute arbitrary code during deserialization via the __reduce__ method:

# VULNERABLE: pickle with untrusted data
import pickle
data = pickle.loads(user_input)  # Arbitrary code execution

There is no way to make pickle safe for untrusted data. The __reduce__ protocol is designed to call arbitrary functions, and there is no allowlist mechanism.

• Equifax (2017): Apache Struts deserialization vulnerability (CVE-2017-9805) was a key vector in the breach exposing 147 million records.
• WebLogic Server: Multiple deserialization RCEs (CVE-2020-14882, CVE-2019-2725) allowed unauthenticated remote code execution on Oracle WebLogic.
• Jenkins: Deserialization vulnerabilities in Jenkins CLI allowed remote attackers to execute commands on the CI/CD server.
• Apache Commons Collections: The discovery of gadget chains in this ubiquitous library (2015) affected virtually every Java application that accepted serialized objects.

CodeSlick identifies insecure deserialization patterns in Java and Python:

• Java: ObjectInputStream.readObject() calls, flagged as Critical when processing potentially untrusted data
• Python: pickle.loads(), pickle.load(), and yaml.load() without safe loader
• Unsafe alternatives: Detects eval() and exec() used for data parsing

All findings are rated Critical with CWE-502 classification. AI-powered fixes suggest safe serialization formats (JSON, Protocol Buffers) and ObjectInputFilter for Java 9+.