Insecure deserialization attacks occur when an application deserializes untrusted data (serialized objects) without proper validation. Attackers craft malicious serialized payloads containing gadget chains that execute arbitrary code (RCE), perform privilege escalation, or cause denial of service (DoS). Deserialization vulnerabilities affect many languages: Java (Apache Commons Collections, Spring, Vaadin), Python (pickle, PyYAML), PHP (unserialize), .NET (BinaryFormatter, Json.NET), Ruby (YAML, Marshal), and Node.js (node-serialize). Log4Shell (CVE-2021-44228) was a deserialization vulnerability. 35% of Java applications have deserialization vulnerabilities (Veracode).
Deserialization Statistics: 35% of Java applications have deserialization vulnerabilities. Average CVSS score: 8.1 (High). Log4Shell (2021) affected 100,000+ applications. ysoserial has 40+ gadget chains for Java.
Common deserialization targets:
Most common deserialization target. Gadget chains: CommonsCollections1-7, Spring, Groovy, Vaadin, BeanShell, JBOSS, Jython. ysoserial generates payloads for RCE (calc.exe, reverse shell).
Python pickle is inherently insecure. __reduce__ method executes arbitrary code. ysoserial for Python exists (Pker). Used in Flask sessions, Django, PySpark.
PHP unserialize vulnerability. Gadget chains in popular frameworks (Laravel, Symfony, Doctrine). __wakeup, __destruct magic methods execute code.
BinaryFormatter, LosFormatter, ObjectStateFormatter are vulnerable. ysoserial.net generates gadget chains for RCE (TypeConfuseDelegate, WindowsIdentity, ActivitySurrogateSelector).
// Java deserialization gadget chain (CommonsCollections1)
// Vulnerable library: Apache Commons Collections 3.1-3.2.1
// Gadget chain: HashMap → AnnotationInvocationHandler → Runtime.exec()
// ysoserial payload generation
java -jar ysoserial.jar CommonsCollections1 "calc.exe"
// Base64-encoded serialized payload (truncated)
rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAAB...
// Python pickle gadget chain (__reduce__)
import pickle
import os
class Exploit(object):
def __reduce__(self):
return (os.system, ('calc.exe',))
payload = pickle.dumps(Exploit())
pickle.loads(payload) # Executes calc.exe
// PHP unserialize gadget chain (Laravel)
// O:35:"Illuminate\Broadcasting\PendingBroadcast":1:{s:12:"*events";O:28:"Illuminate\Events\Dispatcher":1:{s:8:"listeners";a:1:{s:4:"*";a:1:{i:0;O:25:"Illuminate\Bus\Dispatcher":1:{s:6:"*";C;}}}}}
Generates Java deserialization payloads for 40+ gadget chains (CommonsCollections, Spring, Groovy, Vaadin). Supports RCE, reverse shell, file write.
.NET deserialization payload generator (BinaryFormatter, LosFormatter, ObjectStateFormatter). Gadget chains: TypeConfuseDelegate, ActivitySurrogateSelector, WindowsIdentity.
PHP unserialize payload generator for popular frameworks (Laravel, Symfony, Doctrine, Magento, WordPress). RCE gadget chains.
Python pickle payload generator. __reduce__ gadget chains for RCE (os.system, subprocess.Popen).
Burp extension for detecting deserialization vulnerabilities (Java, .NET, PHP). Scans for gadget chain signatures.
// Deserialization attack statistics (2023-2024)
- 35% of Java applications have deserialization vulnerabilities (Veracode)
- 50% of Java deserialization vulnerabilities are in Apache Commons Collections
- 70% of Java applications use vulnerable libraries (Commons Collections, Spring, Groovy)
- Log4Shell (CVE-2021-44228) affected 100,000+ applications (JNDI deserialization)
- Average CVSS score: 8.1 (High - Critical)
- 40+ gadget chains available in ysoserial for Java
- 30+ gadget chains for .NET (ysoserial.net)
- 20+ gadget chains for PHP (PHPGGC)
// Most vulnerable deserialization formats
1. Java serialization (ObjectInputStream): 50%
2. PHP unserialize: 25%
3. Python pickle: 15%
4. .NET BinaryFormatter: 10%
// Top vulnerable libraries (Java)
1. Apache Commons Collections: 40%
2. Spring Framework: 20%
3. Groovy: 10%
4. Vaadin: 8%
5. JBOSS: 7%
6. BeanShell: 5%
This demonstration simulates a Java deserialization attack using ysoserial payload (CommonsCollections1):
This is a simulated demonstration. Real deserialization attacks (ysoserial, PHPGGC) can achieve remote code execution. Defenses: Avoid deserializing untrusted data. Use allowlists (SerialKiller, Look-Ahead Java Deserialization). Use safe formats (JSON, YAML with safe parsers). Implement integrity checks (HMAC, digital signatures). Use Java's Look-Ahead Deserialization (ObjectInputFilter).
Static analysis detects unsafe deserialization calls (ObjectInputStream, readObject, unserialize, pickle.loads). Flags vulnerable libraries.
Burp extension detects Java, .NET, PHP deserialization vulnerabilities. Sends gadget chain payloads, monitors responses.
Detects vulnerable libraries (Apache Commons Collections, Spring, Groovy). Flags CVEs (CVE-2015-6420, CVE-2017-15095).
Never deserialize data from untrusted sources (user input, HTTP requests, network sockets). Use safe formats (JSON, YAML, XML) instead of binary serialization.
Java's ObjectInputFilter (Java 9+) allows only safe classes. SerialKiller (Java 6-8) provides class allowlisting/denylisting.
Look-Ahead pattern validates class names before deserialization. Prevents gadget chain exploitation.
Sign serialized objects with HMAC (Hash-based Message Authentication Code). Verify signature before deserialization. Prevents tampering.
Best Practice - Avoid Deserializing Untrusted Data + Use Allowlists: Never deserialize untrusted data (user input, HTTP requests). Use safe formats (JSON, YAML) instead of binary serialization. Implement allowlists (Java ObjectInputFilter, SerialKiller) to restrict deserializable classes. Use integrity checks (HMAC) to verify serialized data hasn't been tampered. Keep vulnerable libraries (Apache Commons Collections, Spring, Groovy) updated.
Deserialization attacks are illegal when used without authorization (CFAA). Ethical uses include:
Deserialization attacks are illegal when used without authorization. Penalties include:
Important: This guide is for educational and defensive purposes only. Only test deserialization vulnerabilities on systems you own or have explicit written authorization. Responsible disclosure to vendors.
Java deserialization payload generator (40+ gadget chains).
Prevention techniques for Java, .NET, PHP, Python, Ruby deserialization.
Tool for preventing Java deserialization attacks (class allowlisting).