Insecure Deserialization: Why Object Parsing Is Dangerous

Deserialization turns bytes back into objects. If those bytes come from attackers and the runtime does too much while rebuilding, you get gadget chains—not magic, just unplanned object graphs.

You don't need to demo every gadget on day one. Recognizing Java ObjectInputStream, pickle, PHP serialize, and .NET BinaryFormatter in the stack is step one.

Deserialization risks spike during migrations—watch for temporary compatibility endpoints that accept old object formats too long.

Where it hides

Session stores, cache layers, message queues, and 'save user layout' features. Custom RPC and old REST endpoints accept blobs nobody documented.

Microservices trusting signed-but-not-encrypted tokens can still be dangerous depending on design.

Authorized testing angles

Identify inputs that accept encoded objects. Review libraries and versions. Work with devs on safe reproduction in staging—don't drop public exploit chains into production.

• Check for integrity controls vs confidentiality

• Note language-specific safe alternatives

• Map to CWE-502 for reports

Fix direction

Avoid deserializing untrusted data. Use JSON schema formats, HMAC-signed tokens with minimal payloads, and updated libraries without known gadget catalogs.

Deserialization findings are critical when impact is demonstrated safely in scope.

Never run public RCE gadgets against systems without explicit written approval.

Push for language-level safe defaults in new services—even one legacy deserializer left enabled can undo greenfield work.

Language boundaries

Polyglot services may deserialize in more than one format—JSON endpoints sometimes accept YAML by mistake.

Ask devs which library version ships; advisories without version match waste everyone's time.

Migration paths

Push teams toward JSON with strict schemas instead of binary serializers for new features.

If deserialization must remain, advocate allowlists of classes and signed payloads.

Track library CVEs but confirm exploitability in your client's configuration before alarm bells.

---

Worth reading next

RCE and File Inclusion Risks: A High-Level Map for Testers

End of Manual Secure Code Review ...

XXE Attacks: When XML Parsers Become the Risk