You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: _posts/2019-11-22-insecure_deserialization_java.md
+121-7Lines changed: 121 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,21 +5,135 @@ categories: [web_security]
5
5
tags: [java, insecure_deserialization] # TAG names should always be lowercase
6
6
---
7
7
8
-
I was always curious about how the actual remote code execution occurs during the Insecure Deserialization process. So I thought of giving a try to understand the known harmful `gadgets` from `commons-collections-3.2.2.jar` and develop the entire chain from scratch.
8
+
## Concept of Serialization
9
9
10
-
<!-- more -->
11
-
12
-
## Serialization
13
-
14
-
The process of converting the `state` of object into stream of bytes is called `serialization`.
10
+
The process of converting the `state` of object into stream of bytes is called serialization.
15
11
16
12
The purpose of serialization is to save the object’s state to the file system or transmit it over the network for future use.
17
13
18
-
### Serialization in Java
14
+
### In the context of Java
19
15
20
16
> -`Serializable` is a `marker interface`.
21
17
> - It has no `data member` and `method`.
22
18
> - It is only used to `mark` java classes so that objects of these type of classes may get a certain `capability`.
19
+
{: .prompt-info }
23
20
24
21
25
22
Create a `User` class and make it `serializable`.
23
+
24
+
Create an object from the `User` class and save it into the file system in `.ser` format.
-[x] For instance, if a serialized object is created using the `User` class but type checking during deserialization is performed with the `SuperUser` class, then application will throw a `ClassCastException`.
-[x] However, if a serialized object is created using the `SuperUser` class but type checking during deserialization is performed with the `User` class, the application will not throw any exception because `SuperUser` class is derived from the base class `User`.
-[x] Some objects may be required to implement `Serializable` due to inheritance for example `SuperUser`. It inherites the base class `User` that implements `Serializable`.
49
+
50
+
To ensure that such objects (e.g., `SuperUser`) cannot be deserialized, we can override the `readObject()` method and mark it as final to throw an exception during the deserialization process.
1. The readObject method of `java.io.ObjectInputStream` is vulnerable.
57
+
58
+
2. During the Deserialization process, the `readObject()` method is always being called, and it can construct any sort of Serializable object that can be found on the Java classpath before passing it back to the caller for the type_check.
59
+
60
+
3. An Exception occurs only when there’s a type mismatch between the returned object and the expected object. If the constructed object performs any harmful actions during its construction, it’s already too late to prevent them by the time type checking.
61
+
62
+
63
+
## How to Identify
64
+
65
+
From a Blackbox perspective
66
+
1. Look for magic numbers like `AC ED 00 05` or `rO0A` (base64-encoded) in the request/response to identify if the application is handling a serialized object.
67
+
68
+
2. The `Content-Type` header in the HTTP response is set to `application/x-java-serialized-object`.
69
+
70
+
⠀
71
+
From a Whitebox perspective
72
+
1. Search the codebase for Java Serialization APIs such as `ObjectInputStream`, particularly instances of `readObject()` method, and analyze how `ObjectInputStream` is utilized.
73
+
74
+
2. Before calling `readObject()`, ensure the code checks for all expected classes from the serialized object using a `whitelist`.
75
+
76
+
77
+
## What is the Impact
78
+
79
+
1. Remote code execution through `property-oriented programming` or gadget chaining.
80
+
81
+
2. Bypass authorization or escalate privileges via Insecure Direct Object Reference (IDOR) if the object’s signature / authenticity is not verified.
82
+
83
+
3. Denial of Service (DoS) attacks, such as exhausting heap memory, CPU cycle.
84
+
85
+
86
+
## How to Exploit
87
+
88
+
### Denial of Service
89
+
90
+
1. Generate a malicious serialized object.
91
+
92
+
2. During deserialization, when the application attempts to reconstruct the object in memory, it consumes 100% of the CPU resources.
1. Do not blindly accept serialized objects from untrusted sources. Implement integrity checks or sign the serialized objects to prevent tampering or the creation of malicious objects.
101
+
102
+
2. Use a whitelist approach to secure `java.io.ObjectInputStream`
103
+
- Create a `HashSet` containing all expected classes wrapped in the object.
104
+
- Extend `ObjectInputStream` to create a custom `SafeObjectInputStream` class.
105
+
- Override the `resolveClass()` method to verify if `cls.getName()` exists in the `HashSet`, otherwise, throw an `InvalidClassException`.
106
+
107
+
When we provide any object other than `User` type, it throws exception.
> A Denial of Service (DoS) is inevitable if the `expected` object type is a `HashSet`, `HashMap`, or `ArrayList`.
117
+
{: .prompt-danger }
118
+
119
+
120
+
121
+
Defense in depth
122
+
1. Use the `transient` keyword for sensitive fields that you do not want to be serialized. The `transient` keyword prevents a variable, like a password field, from being serialized. When the JVM encounters a variable marked as transient or `static`, it disregards its original value and instead saves the default value corresponding to that variable’s data type.
123
+
124
+
2. For detective controls, log any exceptions or failures that occur during the deserialization process.
125
+
126
+
127
+
3. Use Java Security Manager to block specific classes such as `InvokerTransformer`.
128
+
129
+
```java
130
+
// in current Java, by default enableUnsafeSerialization is set to 'false'
0 commit comments