Deserialization of untrusted data

security

Deserialization of Untrusted Data

Description

Data which is untrusted cannot be trusted to be well formed. Malformed data or unexpected data could be used to abuse application logic, deny service, or execute arbitrary code, when deserialized.

Consequences

  • Availability: The logic of deserialization could be abused to create recursive object graphs or never provide data expected to terminate reading.

  • Authorization: Potentially code could make assumptions that information in the deserialized object about the data is valid. Functions which make this dangerous assumption could be exploited.

  • Access control (instruction processing): malicious objects can abuse the logic of custom deserializers in order to affect code execution.

Exposure period

Requirements specification: A deserialization library could be used which provides a cryptographic framework to seal serialized data.

Implementation: Not using the safe deserialization/serializing data features of a language can create data integrity problems.

Implementation: Not using the protection accessor functions of an object can cause data integrity problems

Implementation: Not protecting your objects from default overloaded functions - which may provide for raw output streams of objects - may cause data confidentiality problems.

Implementation: Not making fields transient can often cause data confidentiality problems.

Github Resources

Reference