How to fix Insecure Deserialization

What an attacker can do

The concrete impact of leaving Insecure Deserialization unpatched.

How to fix Insecure Deserialization

5 ordered steps. Apply them in order — each builds on the previous.

1. 1

   Don't deserialize untrusted data — use JSON instead

   If input comes from the network, a cookie, a request body, or any user-controllable source — use JSON (or another data-only format). Never pickle/yaml.load/unserialize.

   JSON is restrictive by design — it describes strings, numbers, booleans, arrays, objects. No code execution paths. Same for MessagePack, Protobuf, BSON.

   pythonStep 1

   # ❌ Deserializing user-controlled bytes — RCE
   import pickle
   data = pickle.loads(request.body)  # attacker controls request.body
   
   # ❌ yaml.load is also dangerous (loads arbitrary Python objects)
   import yaml
   config = yaml.load(request.body)
   
   # ✅ JSON for arbitrary data
   import json
   data = json.loads(request.body)
   
   # ✅ yaml.safe_load only loads built-in types
   config = yaml.safe_load(request.body)

2. 2

   If you must use a binary format, sign and verify

   When JSON isn't an option (binary protocols, performance), sign the serialized data with HMAC and verify before deserializing. Tampering becomes detectable.

   HMAC with a server-side secret means attackers can't forge the signature — they can only replay or modify data you originally signed. Combined with TTL, this prevents most attacks.

   pythonStep 2

   import hmac, hashlib, pickle, base64
   
   SECRET = os.environ["SERIALIZE_SECRET"].encode()
   
   def sign(data: bytes) -> bytes:
       sig = hmac.new(SECRET, data, hashlib.sha256).digest()
       return base64.b64encode(sig + data)
   
   def verify_and_load(blob: bytes):
       raw = base64.b64decode(blob)
       sig, data = raw[:32], raw[32:]
       expected = hmac.new(SECRET, data, hashlib.sha256).digest()
       if not hmac.compare_digest(sig, expected):
           raise ValueError("Tampered or unsigned data")
       return pickle.loads(data)  # OK — verified
   
   # Even better: don't pickle. Use msgpack with strict types.

3. 3

   Java: replace ObjectInputStream with safer alternatives

   Java's native serialization is fundamentally broken on untrusted input. Use Jackson (JSON), Protobuf, or MessagePack.

   If you must use ObjectInputStream (legacy code), use a class allow-list via Java 9's `ObjectInputFilter` or NotSoSerial library. Otherwise: full RCE via gadget chains.

   javaStep 3

   // ❌ Vulnerable
   ObjectInputStream ois = new ObjectInputStream(request.getInputStream());
   Object obj = ois.readObject();
   
   // ✅ Use Jackson for JSON
   ObjectMapper mapper = new ObjectMapper();
   MyDto dto = mapper.readValue(request.getInputStream(), MyDto.class);
   
   // ✅ If ObjectInputStream is unavoidable: allow-list classes (Java 9+)
   ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
       "com.example.SafeDto;com.example.OtherSafeDto;!*"
   );
   ObjectInputStream ois = new ObjectInputStream(input);
   ois.setObjectInputFilter(filter);

4. 4

   PHP: replace unserialize() with json_decode()

   PHP's `unserialize()` triggers `__wakeup` and `__destruct` methods of any class. Magic methods become attack vectors.

   PHP 7+ supports `unserialize($data, ['allowed_classes' => false])` which limits to plain stdClass. Better: use json_decode for new code; convert legacy unserialize calls.

   phpStep 4

   <?php
   // ❌ Vulnerable — any class with __wakeup is a gadget
   $data = unserialize($_POST['payload']);
   
   // ✅ Use JSON
   $data = json_decode($_POST['payload'], true);
   
   // ✅ If unserialize is unavoidable, allow-list classes (PHP 7+)
   $data = unserialize($_POST['payload'], [
       'allowed_classes' => ['MyDto', 'OtherSafeClass']
   ]);
   
   // Or false to allow only stdClass:
   $data = unserialize($_POST['payload'], ['allowed_classes' => false]);

5. 5

   Audit cookies, query params, and stored data for serialized payloads

   Deserialization vulns hide in places you don't expect: a 'state' cookie that's actually a base64'd pickle, a '__VIEWSTATE' parameter, a Java session cookie. Audit any opaque blob your app accepts.

   If you see base64 strings in cookies/params and your code calls deserialize on them — that's the bug. Replace with signed JSON.

   pythonStep 5

   # Common pattern: encode app state in a cookie
   # ❌ Vulnerable cookie scheme
   @app.route("/setstate", methods=["POST"])
   def set_state():
       state = pickle.dumps(request.get_json())
       resp = make_response("ok")
       resp.set_cookie("state", base64.b64encode(state))
       return resp
   
   @app.route("/getstate")
   def get_state():
       blob = base64.b64decode(request.cookies["state"])
       return pickle.loads(blob)  # RCE if attacker forges cookie
   
   # ✅ Use itsdangerous or signed JWT instead
   from itsdangerous import URLSafeTimedSerializer
   s = URLSafeTimedSerializer(app.config["SECRET_KEY"])
   # encode:
   token = s.dumps(state_dict)
   # decode (verifies signature):
   state_dict = s.loads(token, max_age=3600)