From 7aa3fd859a00db4714d3aa2d00d3f37a02603a63 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Deserializing untrusted data using any deserialization framework that
allows the construction of arbitrary serializable objects is easily exploitable
-and in many cases allows an attacker to execute arbitrary code. Even before a
+and in many cases allows an attacker to execute arbitrary code. Even before a
deserialized object is returned to the caller of a deserialization method a lot
of code may have been executed, including static initializers, constructors,
-and finalizers. Automatic deserialization of fields means that an attacker may
+and finalizers. Automatic deserialization of fields means that an attacker may
craft a nested combination of objects on which the executed initialization code
may have unforeseen effects, such as the execution of arbitrary code.
-There are many different serialization frameworks. This query currently
+There are many different serialization frameworks. This query currently
supports Kryo, XmlDecoder, XStream, SnakeYaml, JYaml, JsonIO, YAMLBeans, HessianBurlap, Castor, Burlap,
Jackson, Jabsorb, Jodd JSON, Flexjson, Gson, JMS, and Java IO serialization through
-Avoid deserialization of untrusted data if at all possible. If the
+Avoid deserialization of untrusted data if at all possible. If the
architecture permits it then use other formats instead of serialized objects,
-for example JSON or XML. However, these formats should not be deserialized
+for example JSON or XML. However, these formats should not be deserialized
into complex objects because this provides further opportunities for attack.
For example, XML-based deserialization attacks
are possible through libraries such as XStream and XmlDecoder.
@@ -43,7 +43,7 @@ Recommendations specific to particular frameworks supported by this query:
FasterXML - FasterXML - ObjectInputStream - ObjectInputStream - SnakeYAML - XML Decoder -
+Note that a deserialization method is only dangerous if it can instantiate
+arbitrary classes. Serialization frameworks that use a schema to instantiate
+only expected, predefined types are generally safe and are not tracked by this
+query. For example, Apache Avro's deserialization methods follow a schema and
+therefore cannot instantiate arbitrary classes, making them safe to use even
+with untrusted data.
+
Note that a deserialization method is only dangerous if it can instantiate
arbitrary classes. Serialization frameworks that use a schema to instantiate
-only expected, predefined types are generally safe and are not tracked by this
-query. For example, Apache Avro's deserialization methods follow a schema and
-therefore cannot instantiate arbitrary classes, making them safe to use even
-with untrusted data.
+only expected, predefined types are generally not tracked by this query. For
+example, Apache Avro's deserialization methods follow a schema and are
+therefore generally safe with respect to arbitrary-class-instantiation and
+gadget-chain attacks when the schema is trusted and does not permit
+user-controlled type resolution.
ObjectInputStream/ObjectOutputStream.
@@ -22,9 +22,9 @@ Jackson, Jabsorb, Jodd JSON, Flexjson, Gson, JMS, and Java IO serialization thro
com.alibaba.fastjson.parser.ParserConfig#setSafeMode with the argument true before deserializing untrusted data.com.fasterxml.jackson.core:jackson-databindcom.fasterxml.jackson.core:jackson-databind
-com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping and don't annotate any object fields with com.fasterxml.jackson.annotation.JsonTypeInfo passing either the CLASS or MINIMAL_CLASS values to the annotation.
@@ -56,16 +56,16 @@ Recommendations specific to particular frameworks supported by this query:
com.esotericsoftware.kryo(5).Kryo#setRegistrationRequired with the argument false on any Kryo instance that may deserialize untrusted data.Java Standard LibraryJava Standard Library
org.apache.commons.io.serialization.ValidatingObjectInputStream.org.apache.commons.io.serialization.ValidatingObjectInputStream.org.yaml:snakeyaml
org.yaml.snakeyaml.constructor.SafeConstructor to org.yaml.snakeyaml.Yaml's constructor before using it to deserialize untrusted data.org.yaml.snakeyaml.constructor.SafeConstructor to org.yaml.snakeyaml.Yaml's constructor before using it to deserialize untrusted data.Standard Java LibraryObjectInputStream/ObjectOutputStream.
+Note that a deserialization method is only dangerous if it can instantiate +arbitrary classes. Serialization frameworks that use a schema to instantiate +only expected, predefined types are generally not tracked by this query. Such +frameworks are generally safe with respect to arbitrary-class-instantiation and +gadget-chain attacks when the schema is trusted and does not permit +user-controlled type resolution. +
Deserializing an object from untrusted input may result in security problems, such as denial of service or remote code execution.
++Note that a deserialization method is only dangerous if it can instantiate +arbitrary classes. Serialization frameworks that use a schema to instantiate +only expected, predefined types are generally not tracked by this query. Such +frameworks are generally safe with respect to arbitrary-class-instantiation and +gadget-chain attacks when the schema is trusted and does not permit +user-controlled type resolution. +
+Deserializing an object from untrusted input may result in security problems, such as denial of service or remote code execution.
++Note that a deserialization method is only dangerous if it can instantiate +arbitrary classes. Serialization frameworks that use a schema to instantiate +only expected, predefined types are generally not tracked by this query. Such +frameworks are generally safe with respect to arbitrary-class-instantiation and +gadget-chain attacks when the schema is trusted and does not permit +user-controlled type resolution. +
++Note that a deserialization method is only dangerous if it can instantiate +arbitrary classes or objects. Serialization frameworks that use a schema to instantiate +only expected, predefined types are generally not tracked by this query. Such +frameworks are generally safe with respect to arbitrary-class-instantiation and +gadget-chain attacks when the schema is trusted and does not permit +user-controlled type resolution. +
ox gem,
do not use parse_obj and load using the non-default :object mode.
Instead use the load method in the default mode or better explicitly set a safe
-mode such as :hash.
+mode such as :hash.
From 93e05db394547c0e085baf6cfa299f4bbf9448d0 Mon Sep 17 00:00:00 2001
From: Owen Mansel-Chan
Deserializing untrusted data using any deserialization framework that
allows the construction of arbitrary serializable objects is easily exploitable
-and in many cases allows an attacker to execute arbitrary code. Even before a
+and in many cases allows an attacker to execute arbitrary code. Even before a
deserialized object is returned to the caller of a deserialization method a lot
of code may have been executed, including static initializers, constructors,
-and finalizers. Automatic deserialization of fields means that an attacker may
+and finalizers. Automatic deserialization of fields means that an attacker may
craft a nested combination of objects on which the executed initialization code
may have unforeseen effects, such as the execution of arbitrary code.
-There are many different serialization frameworks. This query currently
+There are many different serialization frameworks. This query currently
supports Pickle, Marshal and Yaml.
@@ -28,7 +28,7 @@ user-controlled type resolution.
-Avoid deserialization of untrusted data if at all possible. If the
+Avoid deserialization of untrusted data if at all possible. If the
architecture permits it then use other formats instead of serialized objects,
for example JSON.