Java Serialisation: A Modern Fairytale
summary
Java serialization is still widely used but fundamentally unsafe: deserialization runs static initializers while constructors are skipped, letting attackers trigger code without normal validation. Exploits use prebuilt gadget chains (commons-collections examples) and public CVE/exploit databases; attackers find targets via Shodan and open RMI. Defenses shown include serialization filters (Java 9+) and writing a custom ObjectInputStream to validate the metadata, but many frameworks on the classpath still make full mitigation hard.
AI-written summary · about
chapters (5)
related talks
47mA Modern Fairy Tale: Java Serialization
41mHigh-Secure Java Serialization
37mDeserialization in Java - is there still anything to fear?
35mDangerous Serialization
53mWhy We Hate Java Serialization And What We're Doing About It
34mDeserialization: what, how and why [not]
42mEclipse Serializer – Biggest Security Flaw of Java Is Eliminated
45mSerialization & Object Graph Communication