Questions tagged [deserialization]
The deserialization tag has no usage guidance.
10
questions
1
vote
2
answers
118
views
Coverity flags as unsafe deserialisaton. Is this vulnerable?
Coverity shows the block of code as unsafe deserialization:
String str = OBJECT_MAPPER.writeValueAsString(body); //Body is user controlled
Ferarri myclassobj = OBJECT_MAPPER.readValue(str, Ferarri....
- 43
1
vote
0
answers
410
views
Why is there no fix for the commons beanutils Java deserialization gadget?
I recently came across a vulnerability which was caused by unsafe deserialization (Java) and the use of the Apache Commons library commons-beanutils. The ysoserial project references commons-beanutils ...
- 2,634
4
votes
0
answers
184
views
Is Marshal.load safe for Marsha.dumped data
I want to serialize and deserialize models that contain user input. Marshal is a serialization library built into Ruby.
By design, ::load can deserialize almost any class loaded into the Ruby process....
- 195
0
votes
0
answers
44
views
How does "./" affects signature generation for files, in a PHP based web application?
I am solving a lab related to serialization vulnerabilities. It deals with retrieving files based on the signature. The theory of the lab states as quoted, "Adding ./ will still give you the same ...
1
vote
0
answers
407
views
How to decode ysoserial .net payload
Is there any way to decode ysoserial .net payload?
For instance
I'm creating payload with:
ysoserial.exe -f BinaryFormatter -o base64 -c "ping test.com" -g WindowsIdentity
Is there any ...
- 11
0
votes
0
answers
453
views
JSON.Net insecure deserialization
I have a question in regard to insecure deserialization with the JSON.Net component.
It is my understanding that this component is safe by default unless you specify the TypeNameHandling setting to ...
0
votes
1
answer
221
views
Is accepting arbitrary COM pointers over a process boundary safe?
I have a legacy Windows application that needs to be looked over in terms of security. During this review something caught me eye. In the out of process COM server I'm looking at is a method that ...
- 11
1
vote
0
answers
160
views
Exploit CVE-2020-0688 for older versions
I wanted to exploit my IIS CVE-2020-0688, which I saw that the key is the same as advertised.
The problem is that my IIS is old, and uses AppPool of .NET 2 and not .NET 4. Also I can use only GET as ...
- 11
1
vote
0
answers
1k
views
How do gadget chains work in relation to Java Deserialization attacks?
tl;dr
I would love a detailed explanation how user-controlled input goes from readObject to RCE. Java-specific.
The background
This is my attempt to add specificity to the OP question as requested in ...
- 702
0
votes
1
answer
233
views
Deserialization Opportunity?
I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded:
/Account/Register?Count=0&Keys=...
- 366