Insecure Deserialization
Insecure deserialization executes arbitrary code or injects objects while deserializing untrusted data into objects; an OWASP Top 10 vulnerability.
Purpose
To understand the code-execution risk of language-native deserialization and its defenses; a common RCE vulnerability in Java/Python/C#.
Mechanism
Java ObjectInputStream.readObject, Python pickle.loads, and similar invoke object-defined methods during deserialization; attackers craft malicious serialized data to trigger arbitrary code. Defenses: type whitelisting, JSON, signature verification.
Use cases
- Java RCE vulnerabilities
- Python pickle security
- Deserialization defense