Insecure Deserialization Prevention Reference
Reference for insecure deserialization vulnerabilities and prevention in various languages.
Vulnerability Mechanism
Insecure deserialization occurs when untrusted data is deserialized into objects, potentially executing attacker-controlled code. Java (ObjectInputStream), Python (pickle), PHP (unserialize), and .NET (BinaryFormatter) are vulnerable. Gadget chains in common libraries enable code execution from crafted payloads. The attack does not require the application to explicitly call dangerous methods; the deserialization process itself triggers them via magic methods (readObject, __wakeup).
- Java
- ObjectInputStream
- Python
- pickle.loads
- PHP
- unserialize
readObject gadgets__reduce____wakeup/__destructPrevention
Avoid deserializing untrusted data entirely; use JSON or other data-only formats. If unavoidable, use allowlist-based deserialization (Java ObjectInputFilter, .NET DataContractSerializer with known types). Implement integrity checks (HMAC) on serialized data before deserialization. Monitor and log deserialization events. Keep libraries updated to reduce available gadget chains. Language-specific hardened alternatives: Java SerializationFilter, Python json, PHP json_decode.
- avoid
- Use JSON instead
- allowlist
- Known types only
- integrity
- HMAC before deserialize
data-only formatsObjectInputFilterverify signature