Insecure Deserialization
What is Deserializaiton
Serialization is a method of creating binary form from objects. (Useful for transportation and storing information)
Serialized data can be deserialized - transformed from binary form to object which can cause unexpected bahaviours in some cases.
order to better understand deserialization I recommend the following exercise on Pentester Lab: https://pentesterlab.com/exercises/pickle
Video explaination
What causes deserialization vulnerability (Java)
Among many other functions Java uses ObjectInputStream.readObject() in order to deserialize objects.
readObject() alone is just responsible for creating (instantiating) the serialized object and not for checking what kind of object it is.
Not checked object / Invalid object check = Insecure Deserialization
Understanding deserialization
In order to be able to serialize and then de-serialize an object, some conditions have to be met:
An object to be serialized has to implement Serializable interaface
All the classes to be deserialized have to be present on deserializing classpath. Serialization concerns state of an object, but the definition has to be already present on the deserializing side.
Simple serialization / deserialization application
Application below serializes and deserializes Java Objects. It is created by me - I highly encourage you to create your own version of this application since in order to be the best in finding this type of vulnerability we have to create strong fundamentals of this topic in our minds.
Useful resource: https://nytrosecurity.com/2018/05/30/understanding-java-deserialization/
package com.company;
import java.io.*;
public class Main {
public static String filename = "serialized.txt";
public static String variable = "hello world";
public static void main(String[] args) {
serialize();
deserialize();
}
public static void serialize() {
System.out.println("Serializing...");
try {
// Create a file
FileOutputStream fileOutputStream = new FileOutputStream(filename);
// Save object "var" to a file
ObjectOutputStream objectOutputStream = new ObjectOutputStream(fileOutputStream);
objectOutputStream.writeObject(variable);
// closing the streams
objectOutputStream.close();
fileOutputStream.close();
} catch (IOException exception) {
exception.printStackTrace();
}
}
public static void deserialize() {
System.out.println("Deserializing...");
try {
// Read file
FileInputStream fileInputStream = new FileInputStream("serialized.txt");
// Pass the object from file to objectinputstream
ObjectInputStream objectInputStream = new ObjectInputStream(fileInputStream);
// Create object from file contents
Object variable = objectInputStream.readObject();
// Create String from created Object
String variableString = variable.toString();
// Printing the object
System.out.println(variableString);
// closing
objectInputStream.close();
fileInputStream.close();
} catch (Exception exception) {
exception.printStackTrace();
}
}
}
Finding deserialization vulnerabilities (Java)
Deserialization exploits work like a method which is executed upon instantiating an object.
White Box
Look for readObject() functions. They are potential sinks of deserialization vulnerability (of course, if you are able to deliver user-controlled data to them). Even if someone calls a serie of checks after the object is “read”, it’s already too late.
Often software vendors build own wrappers for readObject, e.g. consider a function vendorDeserialize() being present in source code but using ois.readObject() under the hood.
Found sink testing
In order to be able to test deserialization vulnerability, you have also to find a way to deliver the serialized data to the found insecure code during SAST.
Usually, easiest way to spot serialization being in use is to inspect application traffic.
Java serialized objects have a specific signature which easily allow to identify them, which is binary 0xaced0005. It translates to base64 rO0AB.
Serialized java object might be wrapped into any kind of encryption or encoding, thus when dealing with Java application it is worth to dig deeply into any encoded data being sent. That involves e.g. TCP traffic, or HTTP channels like POST parameters, Cookies and Headers.
If there’s any data you suspect of being a serialized Java object, you can use tool named Serialization Dumper tool to inspect it.
One of the fields is SerialUID which is an unique class version identifier. This is something that might cause your payloads to fail, and it’s described later on in “troubleshooting” section along with another issues.
YsoSerial Exploitation
YsoSerial consists of modules named payloads. Each payload generates a serialized object which once instantiated, invokes some kind of action.
The classes that have some specific features making them usable as gadgets are rarely native java classes. They are often more sophisticated objects, which are parts of some commonly used libraries.
How to choose payload
If you look at source code in ysoserial’s payloads, you will find comments indicating proper usage of each payload module.
Existence of serialized objects in communication does not mean that application is vulnerable - this can be as well properly designed serialization.
Recommended labs
Pentesterlab
Portswigger
Source: https://afine.com/testing-and-exploiting-java-deserialization-in-2021
Last updated