Insecure Deserialization

What it is

CWE-502 exists when an application deserializes data from an untrusted source using a deserializer that can instantiate arbitrary objects or trigger code paths during reconstruction. Many serialization formats (Python pickle, Java Serializable, PHP unserialize, .NET BinaryFormatter, Ruby Marshal) allow gadget chains that execute attacker-controlled code during deserialization.

Why it matters

Insecure deserialization typically grants remote code execution with the privileges of the deserializing service. Gadget-chain research has produced reliable exploits for most major serialization libraries. The Apache Commons Collections gadget chain alone has been used in dozens of major breaches over the past decade.

Common patterns

• •Python pickle.load or pickle.loads on data from HTTP requests, message queues, or cache backends.
• •Java ObjectInputStream.readObject on data from network sources.
• •PHP unserialize on cookie or query-string values.
• •.NET BinaryFormatter (deprecated in .NET 5, removed by default in .NET 9).
• •Ruby Marshal.load on session data or cache entries.
• •YAML.load (Python) or YAML.load_file without safe_load on user-supplied YAML.

Languages affected

Example

import pickle
import base64
from flask import request

@app.route('/restore', methods=['POST'])
def restore():
    data = base64.b64decode(request.form['state'])
    state = pickle.loads(data)
    return restore_session(state)

import json
import hmac, hashlib
from flask import request

SECRET = os.environ['SESSION_SIGNING_KEY'].encode()

@app.route('/restore', methods=['POST'])
def restore():
    body = request.form['state']
    payload, sig = body.rsplit('.', 1)
    expected = hmac.new(SECRET, payload.encode(), hashlib.sha256).hexdigest()
    if not hmac.compare_digest(sig, expected):
        abort(403)
    state = json.loads(payload)  # JSON cannot instantiate arbitrary classes
    return restore_session(state)

Where this fits in OWASP Top 10

Compliance framework mapping

Related CWEs