[In]secure Deserialization, And How [Not] To Do It
summary
Live demos show Java deserialization can crash a Tomcat thread with a tiny serialized file and spin CPU to denial of service, Python pickle cookies can spawn a pickle reverse shell that yields root on a misconfigured app, and common gadgets enable remote code execution via Apache Commons and XML-based routes; exploit generators like ysoserial and ysoserial.net (and Metasploit modules discovered across five WebLogic advisories) succeed. Practical fixes include HMAC signature on blobs and strict class whitelisting.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 4:45Demos
- 8:05Session Cookie
- 12:06Demo
- 16:26The problem
- 20:46The solution
- 24:48Big vulnerabilities
- 29:27NetCyberark
- 33:16Conclusion
related talks
23mMight As Well JUMP: Exploit Development For Java Serialization
34mDeserialization: what, how and why [not]
51mMarshalling Pickles
46mThe Anatomy of Java Vulnerabilities
50mStranger Danger: Your Java Attack Surface Just Got Bigger
35mHow To Find The Next Great Deserialization CVE
56mThe Anatomy of Java Vulnerabilities
49mThe Anatomy of Java Vulnerabilities