Profile My skills Saved Collections Edit profile Submit a skill

Insecure JSON Deserialization with Type Polymorphism

Detects JSON deserialization configurations that allow polymorphic type instantiation, enabling object injection attacks.

zakirkun Updated
Coding & Dev Tools

File contents

Insecure JSON Deserialization

Overview

While JSON itself does not execute code, certain JSON library configurations allow attackers to instantiate arbitrary classes through type metadata embedded in JSON. The most notable example is Jackson's enableDefaultTyping() which was responsible for multiple critical CVEs.

Remediation

  • Jackson: Never use enableDefaultTyping(), use @JsonTypeInfo with explicit subtypes
  • Newtonsoft.Json: Avoid TypeNameHandling.All
  • Validate and whitelist expected types before deserialization

zakirkun/ice-tea/tree/main/skills/deserialization/json-deserialize commit 1e44fe4067

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/insecure-json-deserialization-with-type-polymorphism