thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Insecure Deserialization

Deserializing untrusted data in a way that lets an attacker manipulate objects, often leading to remote code execution.

Definition

Native serialization formats (Java ObjectInputStream, .NET BinaryFormatter, Python pickle, PHP unserialize) can instantiate arbitrary classes and trigger gadget chains. Mitigations: do not deserialize untrusted data with native formats, use data-only formats like JSON with schema validation, sign serialized data, apply class allowlists and keep libraries patched.

Example

A Java app deserializes a base64 cookie with ObjectInputStream, allowing code execution via a library gadget chain.

Exam tip

Part of Software and Data Integrity Failures since 2021; the best fix is avoiding native deserialization of untrusted input.

Related terms