TechKnowSurge

VideoSecurityFree

Deserialization Attack

Deserialization attacks exploit the process of converting serialized data back into objects, allowing attackers to inject malicious code that executes when a server processes the payload. This attack vector is classified under CWE-502, Deserialization of Untrusted Data.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Serialization is the process of converting an object, a self-contained unit of data or program logic, into a condensed binary or text format suitable for storage or transmission across a network. Once the serialized data reaches its destination, the receiving system performs deserialization, reconstructing the original object from that raw format. This two-step mechanism is fundamental to how modern applications exchange and persist structured data. A deserialization attack targets the reconstruction phase by replacing or injecting malicious content into the serialized payload before it is processed. When the application deserializes the tampered data, the malicious object is instantiated within the system, potentially granting an attacker code execution, unauthorized access, or control over the affected environment. This vulnerability is classified under CWE-502, Deserialization of Untrusted Data, and arises when an application fails to validate or sanitize serialized input before processing it. Defending against this class of attack requires a clear understanding of how serialized data flows through an application and where untrusted input can enter that pipeline. Recognizing the structure of a deserialization attack, from object creation through serialization, transmission, and reconstruction, is an essential skill for security professionals responsible for assessing and hardening application environments.

What you'll learn

Explain the relationship between serialization and deserialization and how attackers exploit the deserialization process to execute a CWE-502 injection attack

What's covered

Deserialization Attack

Core Concepts
- Object Definition
  - Self-contained data unit
  - Example: Alice's data
- Serialization
  - Converts object to bits
  - Enables storage or transfer
- Deserialization
  - Reverse engineers bits to object
The Attack Process
- Malicious object inserted
- Combined and serialized
- Server deserializes payload
- Malicious code executes
CWE-502 Weakness
- Untrusted data deserialized
- Attack card reference
Ethical Use Reminder
- Educational purposes only
- Protect not compromise

Key terms

Exploit: A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.
Vulnerability: A weakness in a system, application, or process that can be exploited by a threat actor.
Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Serialization: The process of converting an object into a format that can be easily stored or transmitted across a network.
Deserialization: The reverse process of serialization, reconstructing an object from its stored or transmitted format.
CWE-502: A Common Weakness Enumeration entry describing the risk of deserializing untrusted data, which can allow attackers to inject and execute malicious objects.

Topics

Deserialization Serialization Cwe 502 Injection Attacks Application Security Web Security

Transcript

Just a reminder that this is for educational and ethical hacking purposes only. This is to protect systems, not to compromise them. The weakness associated with this deserialization attack is CWE-502, deserialization of untrusted data.

Objects, serialization and deserialization

In order to understand a deserialization attack, let's first of all understand some terminology around serialization and deserialization. First of all, we have an object. An object is like a self-contained unit of information, or some sort of program code, or something that's all kind of self-contained. In this case right here, we've got some data that we're storing, and in this data we have some example information. We've got Alice, who is 30 years old. She is not a student. She has some skills with Python and SQL. So we've got some pieces of information about Alice in this object. This is a single object.

Now, what are the uses for objects? We might want to save the information about this object, or we might want to send this object to another location. Maybe we're sending it to the server. So we're going to manipulate and change and transfer and copy, and we're going to do all sorts of things with these objects.

If we want to do something like saving this object to some sort of storage, or if we want to send it across the network, what we have to do is turn it into some sort of format that can be sent or stored easily. This is called serialization. When we're sending data across the line, it's usually not many bits all at once. We don't have parallel lines; we have what's called serial lines, where we send them across a bit at a time. You can kind of think of it the same way: we need to set or prep this data, these objects, to be sent across one at a time. That's the process called serialization. So what we do is we take this object and we turn it into some sort of condensed format, and then this condensed format is those ones and zeros that are going to be sent across.

Of course, going through this process of serialization and sending it across to the server, what needs to happen is that once it gets over to the server, the server needs to interpret that. That's deserialization: the act of taking these ones and zeros and then reverse engineering it to come up with what the object is.

What a deserialization attack is

So what is a deserialization attack? We've got information here within this object that's going to be sent across to the server. What if we were to replace some or all of the information over here with some sort of malicious code? So what we're going to do is we're going to serialize malicious code and send it over. Then once this server gets that information, it's going to deserialize that information, and then that turns into a malicious attack.

So now we're back to the CWE-502. What we have here is just a description and an actual diagram of what's happening here. We have an object that gets serialized into these ones and zeros, and some sort of malicious user inserts their own malicious object into here, and then it gets combined and sent over to the product, and when that product deserializes that, now it has access to this malicious object, which causes the problem.

Essentially what we're doing is we're serializing a malicious object, and maybe in this case right here we're sending it over to a server, so that when that server deserializes that object, then it exists on that server or within that product, and it's associated with CWE-502.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →