Insecure Deserialisation

Insecure deserialisation occurs when an application does not properly validate or sanitize untrusted input during the deserialization process, leading to arbitrary code execution and denial of service. Deserialization is the process of converting serialized data (e.g., from JSON, XML, or other formats) back into an object or data structure that can be used within a program.

Remediation

Where possible avoid using untrusted data in serialisation process.
Use safe libraries that segregate data from the code during deserialisation and perform contextual escaping.

Metadata

Severity: critical
Slug: insecure-deserialisation

CWEs

502: Deserialization of Untrusted Data

OWASP

A03:2021: Injection
A8:2017: Insecure Deserialization

Available Labs

Select a language to explore available labs for this vulnerability.

1 Lab

Artificial Intelligence Labs

Artificial Intelligence 1 lab

Explore 1 lab in Artificial Intelligence.

1 Lab

Csharp Labs

Csharp 1 lab

Explore 1 lab in Csharp.

1 Lab

Go Labs

Go 1 lab

Explore 1 lab in Go.

1 Lab

Java Labs

Java 1 lab

Explore 1 lab in Java.

1 Lab

Javascript Labs

Javascript 1 lab

Explore 1 lab in Javascript.

1 Lab

Php Labs

Php 1 lab

Explore 1 lab in Php.

1 Lab

Python Labs

Python 1 lab

Explore 1 lab in Python.

1 Lab

Typescript Labs

Typescript 1 lab

Explore 1 lab in Typescript.

No matching labs found

Try adjusting your language filter.

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.