1. Executive Summary & Scope
Insecure Deserialization occurs when an application deserializes untrusted data provided by the user without validation. In languages like PHP (`unserialize`), Java (`ObjectInputStream`), or Python (`pickle`), serialized streams can instantiate arbitrary object gadget chains that lead to remote code execution.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-502 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
Attackers craft malicious serialized payloads triggering magic methods (`__destruct`, `__wakeup`, `__toString`) within loaded framework classes, achieving remote command execution on the web server.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Passing untrusted cookie or request parameter to unserialize
$userPreferences = unserialize($_COOKIE['prefs']); // Critical RCE vulnerability!
Hardened Defense-in-Depth Implementation
// REMEDIATED: Use standard JSON encoding with strict schema validation
// JSON is data-only and cannot instantiate arbitrary class objects or magic methods
$rawInput = $_COOKIE['prefs'] ?? '{}';
$userPreferences = json_decode($rawInput, true);
if (json_last_error() !== JSON_ERROR_NONE || !is_array($userPreferences)) {
$userPreferences = []; // Fallback to safe default state
}
// If PHP native serialization MUST be used, disable class instantiation:
$safeObject = unserialize($data, ['allowed_classes' => false]);
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Serialized Class Injection | Submit crafted PHP serialized string (`O:4:"User":...`) to input parameters. | Application rejects string or decodes as pure string without invoking class constructors. |
| Static Analysis Grep | Search codebase for `unserialize(` without `allowed_classes => false`. | Zero unchecked instances of `unserialize` found in repository. |
| Pickle / Java Object Stream Inspection | Audit all socket and file communication endpoints for binary serialization formats. | All inter-service APIs use strictly typed JSON or Protocol Buffers. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.