Questions tagged [deserialization]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
10 views

Why is there no fix for the commons beanutils Java deserialization gadget?

I recently came across a vulnerability which was caused by unsafe deserialization (Java) and the user of the Apache Commons library commons-beanutils. The ysoserial project references commons-...
user avatar
  • 2,624
0 votes
0 answers
45 views

How to find a potential JSON Java deserialization code vulnerability with a whitebox approach in web server source code?

I would like to know a somewhat general approach for white box vulnerability scanning, mainly focused around Java deserialization code bugs that could lead to RCEs (Remote Code Execution following ...
user avatar
3 votes
0 answers
45 views

Is Marshal.load safe for Marsha.dumped data

I want to serialize and deserialize models that contain user input. Marshal is a serialization library built into Ruby. By design, ::load can deserialize almost any class loaded into the Ruby process....
user avatar
  • 185
0 votes
0 answers
34 views

How does "./" affects signature generation for files, in a PHP based web application?

I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
user avatar
1 vote
0 answers
162 views

How to decode ysoserial .net payload

Is there any way to decode ysoserial .net payload? For instance I'm creating payload with: ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity Is there any ...
user avatar
  • 11
0 votes
0 answers
96 views

Is Java native serialization safe if objects contains fields that are under attacker control?

I'm currently setting up a Java application that should cache objects in Redis. One of the options to serialize/deserialize the objects is the Java Native serialization. I know that object ...
user avatar
0 votes
0 answers
135 views

Unserialize URI with PHP and nginx to gain RCE

I stumbled upon this abomination in the code base of a project I'm working on and wondered if it constitutes a security issue. $requestUri = explode('?', $_SERVER['REQUEST_URI']); $requestUri = ...
user avatar
0 votes
0 answers
170 views

JSON.Net insecure deserialization

I have a question in regard to insecure deserialization with the JSON.Net component. It is my understanding that this component is safe by default unless you specify the TypeNameHandling setting to ...
user avatar
0 votes
1 answer
187 views

Is accepting arbitrary COM pointers over a process boundary safe?

I have a legacy Windows application that needs to be looked over in terms of security. During this review something caught me eye. In the out of process COM server I'm looking at is a method that ...
user avatar
  • 1
1 vote
0 answers
145 views

Exploit CVE-2020-0688 for older versions

I wanted to exploit my IIS CVE-2020-0688, which I saw that the key is the same as advertised. The problem is that my IIS is old, and uses AppPool of .NET 2 and not .NET 4. Also I can use only GET as ...
user avatar
1 vote
0 answers
837 views

How do gadget chains work in relation to Java Deserialization attacks?

tl;dr I would love a detailed explanation how user-controlled input goes from readObject to RCE. Java-specific. The background This is my attempt to add specificity to the OP question as requested in ...
user avatar
0 votes
1 answer
198 views

Deserialization Opportunity?

I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded: /Account/Register?Count=0&Keys=...
user avatar