What is Deserialization of Untrusted Data (CWE-502)?

TL;DR: Deserialization of Untrusted Data (CWE-502) is a security vulnerability where an application processes unvalidated serialized data, leading to potential code execution. Fix by implementing robust input validation.

What is Deserialization of Untrusted Data?

Deserialization of Untrusted Data (CWE-502) is a type of software vulnerability that occurs when an application processes serialized data without proper validation. As defined by the MITRE Corporation under CWE-502, and classified by the OWASP Foundation under A08:2025 - Software or Data Integrity Failures.

Quick Summary

Deserialization of Untrusted Data is a critical security issue where unvalidated serialized input can lead to arbitrary code execution. This vulnerability affects various technologies including Java, Python, .NET, and Node.js. It poses significant risks to integrity and availability, leading to unexpected state changes and denial-of-service attacks. Jump to: Deserialization of Untrusted Data Overview · How Deserialization of Untrusted Data Works · Business Impact of Deserialization of Untrusted Data · Deserialization of Untrusted Data Attack Scenario · How to Detect Deserialization of Untrusted Data · How to Fix Deserialization of Untrusted Data · Framework-Specific Fixes for Deserialization of Untrusted Data · How to Ask AI to Check Your Code for Deserialization of Untrusted Data · Deserialization of Untrusted Data Best Practices Checklist · Deserialization of Untrusted Data FAQ · Vulnerabilities Related to Deserialization of Untrusted Data

Jump to: Quick Summary · Deserialization of Untrusted Data Overview · How Deserialization of Untrusted Data Works · Business Impact of Deserialization of Untrusted Data · Deserialization of Untrusted Data Attack Scenario · How to Detect Deserialization of Untrusted Data · How to Fix Deserialization of Untrusted Data · Framework-Specific Fixes for Deserialization of Untrusted Data · How to Ask AI to Check Your Code for Deserialization of Untrusted Data · Deserialization of Untrusted Data Best Practices Checklist · Deserialization of Untrusted Data FAQ · Vulnerabilities Related to Deserialization of Untrusted Data · References · Scan Your Own Site

Deserialization of Untrusted Data Overview

What: Deserialization of Untrusted Data is a vulnerability where an application processes serialized data without proper validation, leading to potential code execution.

Why it matters: Attackers can exploit this weakness to execute arbitrary code, compromising integrity and availability.

Where it occurs: In applications that deserialize untrusted input, such as Java’s ObjectInputStream or Python’s pickle module.

Who is affected: Developers and organizations using technologies like Java, Python, .NET, and Node.js.

Who is NOT affected: Applications that do not deserialize user-provided data.

How Deserialization of Untrusted Data Works

Root Cause

The root cause lies in the lack of proper validation when deserializing untrusted input. This allows attackers to inject malicious code or modify objects unexpectedly.

Attack Flow

1. Attacker sends serialized payload to the application.
2. Application deserializes the data without validation.
3. Malicious code executes, leading to unauthorized actions.

Prerequisites to Exploit

• Unvalidated deserialization process in place.
• Presence of a vulnerable serialization mechanism (e.g., Java’s ObjectInputStream).

Vulnerable Code

public void deserializeData(String input) {
    try {
        ByteArrayInputStream bis = new ByteArrayInputStream(input.getBytes());
        ObjectInput in = new ObjectInputStream(bis);
        Object obj = in.readObject();
        // Process the object...
    } catch (Exception e) {
        System.err.println("Failed to deserialize: " + e.getMessage());
    }
}

Secure Code

public void deserializeData(String input) {
    try {
        ByteArrayInputStream bis = new ByteArrayInputStream(input.getBytes());
        ObjectInput in = new ObjectInputStream(bis);
        byte[] data = (byte[]) in.readObject();
        // Validate and sanitize the data before deserializing.
        Object obj = new SafeDeserializer().deserialize(data);
        // Process the object...
    } catch (Exception e) {
        System.err.println("Failed to deserialize: " + e.getMessage());
    }
}

Business Impact of Deserialization of Untrusted Data

Integrity: Attackers can modify unexpected objects or data, leading to unauthorized state changes.

Availability: Resource consumption attacks may cause denial-of-service conditions.

• Financial loss due to service disruption.
• Reputational damage from security breaches.
• Compliance penalties for failing to protect sensitive information.

Deserialization of Untrusted Data Attack Scenario

1. Attacker crafts a serialized payload containing malicious code.
2. Payload is sent to the application’s deserialization endpoint.
3. Application processes and executes the malicious code, leading to unauthorized actions or service disruption.

How to Detect Deserialization of Untrusted Data

Manual Testing

• Test for unvalidated deserialization by sending crafted payloads.
• Verify that the application properly validates serialized data before processing it.

Automated Scanners (SAST / DAST)

Static analysis can detect code patterns indicative of deserialization vulnerabilities. Dynamic testing involves injecting serialized payloads to observe behavior.

PenScan Detection

PenScan’s scanner engines like ZAP, Nuclei, Wapiti, and Nikto can identify potential CWE-502 issues by analyzing HTTP traffic for suspicious payloads.

False Positive Guidance

False positives may occur if the application processes legitimate serialized data without malicious intent. Ensure that any flagged code actually handles untrusted input.

How to Fix Deserialization of Untrusted Data

• Use secure serialization libraries (e.g., Apache Commons Lang’s SerializationUtils).
• Implement strict input validation before deserializing.
• Avoid using unsafe deserialization mechanisms like Java’s ObjectInputStream.

Framework-Specific Fixes for Deserialization of Untrusted Data

Java

public void deserializeData(String input) {
    try {
        ByteArrayInputStream bis = new ByteArrayInputStream(input.getBytes());
        ObjectInput in = new SafeObjectInputStream(bis);
        byte[] data = (byte[]) in.readObject();
        // Validate and sanitize the data before deserializing.
        Object obj = new SafeDeserializer().deserialize(data);
        // Process the object...
    } catch (Exception e) {
        System.err.println("Failed to deserialize: " + e.getMessage());
    }
}

How to Ask AI to Check Your Code for Deserialization of Untrusted Data

Review the following Java code block for potential CWE-502 Deserialization of Untrusted Data vulnerabilities and rewrite it using secure deserialization techniques:

public void deserializeData(String input) {
    try {
        ByteArrayInputStream bis = new ByteArrayInputStream(input.getBytes());
        ObjectInput in = new SafeObjectInputStream(bis);
        byte[] data = (byte[]) in.readObject();
        // Validate and sanitize the data before deserializing.
        Object obj = new SafeDeserializer().deserialize(data);
        // Process the object...
    } catch (Exception e) {
        System.err.println("Failed to deserialize: " + e.getMessage());
    }
}

Deserialization of Untrusted Data Best Practices Checklist

✅ Use secure serialization libraries to handle untrusted data. ✅ Implement strict input validation before deserializing objects. ✅ Avoid using unsafe deserialization mechanisms like Java’s ObjectInputStream.

Deserialization of Untrusted Data FAQ

How does deserialization of untrusted data work?

Deserialization of untrusted data occurs when an application processes serialized input without validating or sanitizing it, allowing attackers to inject malicious code.

What are the common consequences of CWE-502 in terms of integrity and availability?

Integrity issues can lead to unexpected state changes and modified objects. Availability issues may result in denial-of-service attacks through resource consumption.

Can you provide real-world examples of deserialization vulnerabilities?

Real-world examples include Java’s ObjectInputStream, which allows attackers to inject malicious classes during deserialization.

How can I detect deserialization of untrusted data using manual testing methods?

Manually test by injecting serialized payloads and observing the application’s response for unexpected behavior or errors.

What are some best practices to prevent CWE-502 in Python applications?

Use libraries like Apache Commons Lang’s SerializationUtils to ensure safe deserialization practices.

How can I fix existing code that is vulnerable to CWE-502?

Implement input validation and use secure serialization techniques such as JSON Web Tokens (JWT) instead of raw object serialization.

What are the common false positives when using automated scanners for detecting deserialization vulnerabilities?

False positives may occur if the scanner identifies legitimate serialized data without malicious intent.

Vulnerabilities Related to Deserialization of Untrusted Data

| CWE | Name | Relationship | |—|—|—| | CWE-913 | Improper Control of Dynamically-Managed Code Resources (ChildOf) | ChildOf | | CWE-913 | Improper Control of Dynamically-Managed Code Resources (ChildOf) | ChildOf | | CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes (PeerOf) | PeerOf |

References

• MITRE - CWE-502
• OWASP Top 10: A08:2025 Software or Data Integrity Failures
• CAPEC - CAPEC-586
• NVD - NIST Vulnerability Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Deserialization of Untrusted Data and other risks before an attacker does.