Unsafe MessagePack Deserialization

Detects MessagePack deserialization configured to allow arbitrary object construction.

zakirkun c62424d 2 files · 1.8 KB Updated

File contents

Unsafe MessagePack Deserialization

Overview

MessagePack is generally safer than pickle/Java serialization, but certain configurations and extensions can allow type coercion or code execution when combined with object extensibility features.

Remediation

  • Use raw=True in Python msgpack to avoid string coercion
  • Validate deserialized data against a schema before use
  • Do not pass deserialized objects directly to code execution paths

zakirkun/ice-tea/tree/main/skills/deserialization/msgpack-unsafe commit c62424d2ee

Frequently asked questions

npx skillmds@latest add zakirkun/unsafe-messagepack-deserialization