Java Insecure Deserialization (ObjectInputStream)

Detects Java ObjectInputStream.readObject() on untrusted data, enabling remote code execution via gadget chains.

zakirkun 3628d84 2 files · 2.7 KB Updated

File contents

Java Insecure Deserialization

Overview

Java's ObjectInputStream.readObject() deserializes objects from byte streams. When called with untrusted data, attackers can use "gadget chains" from libraries like Commons Collections, Spring, and Apache to achieve Remote Code Execution.

Famous exploits: Apache Struts, Jenkins, WebLogic, JBoss all suffered RCE from this vulnerability.

Remediation

  • Replace Java serialization with JSON/XML with schema validation
  • Use ObjectInputFilter (Java 9+) to restrict deserializable classes
  • Use serialization filtering frameworks like SerialKiller

zakirkun/ice-tea/tree/main/skills/deserialization/java-object-input-stream commit 3628d84495

Frequently asked questions

npx skillmds@latest add zakirkun/java-insecure-deserialization-objectinputstream