Why is Java deserialization of untrusted data dangerous?
Options
- Crafted objects can trigger gadget chains and RCE (Correct option)
- It only makes the program run slower overall
- It deletes the JVM from the server machine
- It only affects Python programs, never Java ones
Answer
Reading attacker-controlled serialized objects can trigger malicious code through "gadget chains" in classes on the classpath, leading to remote code execution
Why
Java's native serialization (ObjectInputStream.readObject) rebuilds objects from bytes. Special classes run code during that process. An attacker can craft bytes that chain existing classes (a gadget chain) to execute commands.
Mitigations: do not deserialize untrusted data; prefer JSON with strict schemas (Jackson with default typing disabled); use serialization filters (ObjectInputFilter); keep libraries updated.
It is the Java version of the pickle.loads problem.
Remember
Never deserialize untrusted Java objects.