Chapter 37 — Deserialization attacks

How it works

Why it's RCE and not just "weird objects": the serializer, on reading the stream, constructs objects and calls lifecycle methods (readObject, __wakeup/__destruct, __reduce__, readExternal, deserialization callbacks). A "gadget chain" is a sequence of classes already on your classpath whose lifecycle methods, when wired together via the crafted object graph, end in Runtime.exec / ProcessBuilder / system() / a JNDI lookup / a reflected method call.

   JAVA
     Sink: `ObjectInputStream.readObject()` on untrusted data. Also RMI,
       JMX, JNDI (Log4Shell class), some JSON libs with type info
       (Jackson `enableDefaultTyping`, `fastjson` autotype), XMLDecoder,
       `Yaml.load` (SnakeYAML).
     Chains: Apache Commons-Collections (1-7), Commons-BeanUtils, Spring,
       Groovy, ROME, C3P0, Hibernate, Click, Vaadin -- `ysoserial`
       generates payloads for ~30.
     Recognise: magic bytes `AC ED 00 05` (hex) / base64 starts `rO0`.
     Also: gadget chains that trigger a JNDI lookup -> LDAP/RMI ->
       remote class load (the Log4Shell mechanism) even without a local
       exec gadget.
   .NET
     Sinks: `BinaryFormatter` (removed in .NET 9, still everywhere in
       .NET Framework), `LosFormatter` / `ObjectStateFormatter` ->
       ASP.NET VIEWSTATE (if MAC disabled OR the machineKey is known/
       default -> RCE), `SoapFormatter`, `NetDataContractSerializer`,
       `Json.NET` with `TypeNameHandling != None`, `JavaScriptSerializer`
       + a `SimpleTypeResolver`, `fastJSON`, `XmlSerializer` with an
       attacker-controlled type, `DataContractSerializer` similarly.
     Tool: `ysoserial.net` (TypeConfuseDelegate, ActivitySurrogate-
       Selector, ObjectDataProvider, ...). ViewState: `--generator=` +
       the machineKey.
   PYTHON
     Sinks: `pickle.loads` / `cPickle` / `_pickle`, `shelve`, `dill`,
       `pandas.read_pickle`, `numpy.load(allow_pickle=True)`,
       `joblib.load`, `torch.load` (pre-2.6 default), `yaml.load` without
       `SafeLoader` (`!!python/object/apply:os.system ['id']`),
       `jsonpickle`.
     Mechanism: a class defines `__reduce__(self): return (os.system,
       ('id',))` -> unpickling calls it. Trivial to write; no gadget
       hunting needed.
   PHP
     Sink: `unserialize()` on untrusted input -> POP chains via magic
       methods (`__wakeup`, `__destruct`, `__toString`, `__call`,
       `__get`) of classes in the app + frameworks (Laravel, Symfony,
       Monolog, Guzzle, ...). Tool: `PHPGGC`.
     PHAR: `phar://` wrapper triggers `unserialize` of the phar's
       metadata on ANY filesystem op (`file_exists`, `fopen`,
       `getimagesize`, `is_file`, ...) with a crafted `.phar` -- no
       explicit `unserialize()` call needed (mostly PHP < 8, but check).
   RUBY
     Sinks: `Marshal.load`, `YAML.load` (Psych: `--- !ruby/object:...`),
       `Oj.load` in some modes, `CSV` with converters.
     "Universal" gadget chains exist for recent Ruby/Rails
       (`universal_deserialisation_gadget`).
   NODE
     Sinks: `node-serialize` (`{"x":"_$$ND_FUNC$$_function(){...}()"}`
       -> IIFE RCE), `serialize-javascript` misused, `funcster`, `cryo`.
       Also prototype pollution via `JSON.parse` + merge (Ch 34).

Defence:

   [ ] DON'T deserialize untrusted data with a native serializer. Use a
       DATA format with no code semantics: JSON (plain), Protocol Buffers,
       MessagePack, CBOR -- parsed into known DTOs / schemas.
   [ ] If you MUST accept a serialized object:
       Java  -- `ObjectInputFilter` (JEP 290): an ALLOWLIST of expected
                classes + limits (depth, refs, array size). Reject
                everything else. Consider SerialKiller / NotSoSerial.
       .NET  -- don't use BinaryFormatter; `Json.NET` with
                `TypeNameHandling.None`; ViewState: enable MAC +
                encryption, unique per-app `machineKey`, `ViewStateUserKey`.
       Python-- `yaml.safe_load` always; never unpickle untrusted; if a
                trusted pickle must cross a boundary, HMAC-sign it and
                verify before loading. `torch.load(weights_only=True)`.
       PHP   -- `json_decode`; `unserialize($data, ['allowed_classes' =>
                false])`; set `phar.readonly=1`; be wary of filesystem
                functions on user-controlled paths (phar).
       Ruby  -- `YAML.safe_load` (permitted_classes allowlist); `JSON`.
   [ ] Type-info in JSON: Jackson -> never `enableDefaultTyping` /
       `@JsonTypeInfo` with a permissive base; fastjson -> `safeMode`.
   [ ] Integrity: sign serialized blobs you legitimately round-trip
       through a client (HMAC), and verify before deserializing --
       though "don't deserialize untrusted" is still better.
   [ ] Network: the deserializing process with no outbound (kills JNDI/
       LDAP remote class load) and least privilege.