CWE-502 (可信数据的反序列化) — Vulnerability Class 2494

2494 vulnerabilities classified as CWE-502 (可信数据的反序列化). AI Chinese analysis included.

CWE-502 represents a critical security weakness where applications deserialize untrusted data without validating its integrity or structure. Attackers typically exploit this vulnerability by crafting malicious serialized objects that, when processed by the application, trigger unintended code execution or logic flaws. This often leads to remote code execution, denial of service, or privilege escalation, as the deserialization process may instantiate dangerous classes or invoke unsafe methods. To mitigate this risk, developers must strictly avoid deserializing data from untrusted sources. Instead, they should implement robust input validation, use allowlists for permitted data types, or adopt safer serialization formats like JSON that do not inherently support arbitrary object instantiation. Additionally, employing cryptographic signatures to verify data authenticity before deserialization ensures that only trusted, unaltered payloads are processed, effectively neutralizing the threat of malicious object injection.

MITRE CWE Description

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Common Consequences (3)

Integrity Modify Application Data, Unexpected State

Attackers can modify unexpected objects or data that was assumed to be safe from modification. Deserialized data or code could be modified without using the provided accessor functions, or unexpected functions could be invoked.

Availability DoS: Resource Consumption (CPU)

If a function is making an assumption on when to terminate, based on a sentry in a string, it could easily never terminate.

Other Varies by Context

The consequences can vary widely, because it depends on which objects or methods are being deserialized, and how they are used. Making an assumption that the code in the deserialized object is valid is dangerous and can enable exploitation. One example is attackers using gadget chains to perform una…

Mitigations (5)

Architecture and Design, Implementation If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.

Implementation When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Implementation Explicitly define a final object() to prevent deserialization.

Architecture and Design, Implementation Make fields transient to protect them from deserialization. An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

Implementation Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are…

Examples (2)

This code snippet deserializes an object from a file and uses it as a UI button:

try { File file = new File("object.obj"); ObjectInputStream in = new ObjectInputStream(new FileInputStream(file)); javax.swing.JButton button = (javax.swing.JButton) in.readObject(); in.close(); }

Bad · Java

private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Cannot be deserialized"); }

Good · Java

In Python, the Pickle library handles the serialization and deserialization processes. In this example derived from [REF-467], the code receives and parses data, and afterwards tries to authenticate a user based on validating a token.

try { class ExampleProtocol(protocol.Protocol): def dataReceived(self, data): # Code that would be here would parse the incoming data # After receiving headers, call confirmAuth() to authenticate def confirmAuth(self, headers): try: token = cPickle.loads(base64.b64decode(headers['AuthToken'])) if not check_hmac(token['signature'], token['data'], getSecretKey()): raise AuthFail self.secure_data = token['data'] except: raise AuthFail }

Bad · Python

CVE ID	Title	CVSS	Severity	Published
CVE-2017-0903	RubyGems 安全漏洞 — RubyGems	9.8	-	2017-10-11
CVE-2017-12149	Red Hat JBoss Enterprise Application Platform Jboss Application Server 安全漏洞 — jbossas	9.8	-	2017-10-04
CVE-2017-11153	Synology Photo Station 安全漏洞 — Synology Photo Station	9.8	-	2017-08-08
CVE-2017-7504	Red Hat Jboss Application Server 安全漏洞 — JBoss	9.8	-	2017-05-19

Vulnerabilities classified as CWE-502 (可信数据的反序列化) represent 2494 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.