Insecure deserialization: understanding the risk
Saving the state of an application so it can be restored later is a routine operation. But when data from outside is restored without precautions, this convenience can turn into a critical vulnerability, up to code execution.
Serialization, deserialization: what are we talking about?
Serialization consists of converting the state of an application into a format suitable for transfer or storage (saving the progress of a game, the content of an online editor, etc.). Deserialization is the reverse operation: rebuilding the state from that data.
The problem arises when the application deserializes data controlled by the user without verifying it. Depending on the language and libraries, a carefully crafted malicious object can then trigger unexpected behavior, up to remote code execution. A recurring risk in application security.
Why it is dangerous
Code execution
In the worst case, a trapped object leads to code execution on the server (RCE) and to its compromise.
Object tampering
Modify the attributes of a deserialized object to change permissions, amounts, or a status.
Denial of service
Force the deserialization of costly structures to saturate the application's resources.
A subtle vulnerability
The serialized format is often opaque (binary, encoded): the vulnerability can easily go unnoticed during a quick review.
Where the risk hides
Serialized data often circulates in unexpected places: cookies, tokens, hidden fields, message queues, caches, API parameters. As soon as one of these sources is controllable by the user and deserialized without checks, the risk exists. This is one of the reasons why incoming data should never be blindly trusted, a principle common toSQL injection as well as to XSS.
The principle: do not deserialize untrusted data
The best protection is to avoid deserializing data from untrusted sources. When this is unavoidable, prefer simple data formats (such as JSON processed by a strict parser) rather than native object serialization, verify data integrity (signature), restrict authorized types (allowlist), and apply least privilege. These protections are validated through a penetration test.
Protect yourself, step by step
Avoid untrusted deserialization
Do not deserialize data coming directly from the user when it can be avoided.
Prefer simple formats
Use data formats (JSON) with a strict parser rather than native object serialization.
Verify integrity
Sign legitimate serialized data to detect any tampering before processing it.
Restrict types
Limit the classes/types authorized for deserialization by allowlist.
Segment & limit
Apply least privilege to reduce the impact of a successful exploitation.
Why get support from BCIT?
Identify sensitive points
We identify exposed deserialization flows in your application.
Concrete fixes
Recommendations tailored to your language and libraries.
A comprehensive approach
From application security to audits, the entire chain.
Not ready to talk yet? Discover our cybersecurity assessment →
Restore your data without opening a breach 🚀
Let's take 15 minutes to assess your serialization practices and secure at-risk flows.
Insecure deserialization: understanding the risk
Saving the state of an application so it can be restored later is a routine operation. But when data from outside is restored without precautions, this convenience can turn into a critical vulnerability, up to code execution.
Serialization, deserialization: what are we talking about?
Serialization consists of converting the state of an application into a format suitable for transfer or storage (saving the progress of a game, the content of an online editor, etc.). Deserialization is the reverse operation: rebuilding the state from that data.
The problem arises when the application deserializes data controlled by the user without verifying it. Depending on the language and libraries, a carefully crafted malicious object can then trigger unexpected behavior, up to remote code execution. A recurring risk in application security.
Why it is dangerous
Code execution
In the worst case, a trapped object leads to code execution on the server (RCE) and to its compromise.
Object tampering
Modify the attributes of a deserialized object to change permissions, amounts, or a status.
Denial of service
Force the deserialization of costly structures to saturate the application's resources.
A subtle vulnerability
The serialized format is often opaque (binary, encoded): the vulnerability can easily go unnoticed during a quick review.
Where the risk hides
Serialized data often circulates in unexpected places: cookies, tokens, hidden fields, message queues, caches, API parameters. As soon as one of these sources is controllable by the user and deserialized without checks, the risk exists. This is one of the reasons why incoming data should never be blindly trusted, a principle common toSQL injection as well as to XSS.
The principle: do not deserialize untrusted data
The best protection is to avoid deserializing data from untrusted sources. When this is unavoidable, prefer simple data formats (such as JSON processed by a strict parser) rather than native object serialization, verify data integrity (signature), restrict authorized types (allowlist), and apply least privilege. These protections are validated through a penetration test.
Protect yourself, step by step
Avoid untrusted deserialization
Do not deserialize data coming directly from the user when it can be avoided.
Prefer simple formats
Use data formats (JSON) with a strict parser rather than native object serialization.
Verify integrity
Sign legitimate serialized data to detect any tampering before processing it.
Restrict types
Limit the classes/types authorized for deserialization by allowlist.
Segment & limit
Apply least privilege to reduce the impact of a successful exploitation.
Why get support from BCIT?
Identify sensitive points
We identify exposed deserialization flows in your application.
Concrete fixes
Recommendations tailored to your language and libraries.
A comprehensive approach
From application security to audits, the entire chain.
Not ready to talk yet? Discover our cybersecurity assessment →
Restore your data without opening a breach 🚀
Let's take 15 minutes to assess your serialization practices and secure at-risk flows.