Insecure Deserialization :-

4 years ago 135

BOOK THIS SPACE FOR AD

ARTICLE AD

Insecure Deserialization :-

Hello all ,

This is my another write up for last bug that I have found.

Bug name :- Insecure Deserialization

Description :-

In computer science, an object is a data structure; in other

words, a way to structure data. Two key concepts make it

easier to understand:

• The process of serialization is converting objects to byte

strings.

• The process of deserialization is converting byte strings

to objects.

If a website use a PHP forum that uses PHP object serialization
to save a “super” cookie, containing the user’s user ID, role,

password hash, and other state:

Example,

Steps to reproduce :-

a:4:{i:0;i:132;i:1;s:7:”user-1”;i:2;s4:”user”;

i3;s32:”b6a8b3bea87fe0e05022f8f3c88bc960”;}

An attacker changes the serialized object to give themselves

Another user privileges:

a:4:{i:0;i:1;i:1;s:5:”user-2”;i:2;s:5:”user”;

;s32:”b6a8b3bea87fe0e05022f8f3c88bc960”;}

Impact :-

If an attacker is able to deserialize an object successfully, then

modify the object to give himself an admin role, they can serialize

it again. This set of actions could compromise the whole web

application.

Mitigations :-

The best way to protect your web application from this type of risk is not to

accept serialized objects from untrusted sources.

• Implementing integrity checks such as digital signatures on any

serialized objects to prevent hostile object creation or data tampering.

• Enforcing strict type constraints during deserialization before object

creation as the code typically expects a definable set of classes.

• Bypasses to this technique have been demonstrated, so reliance

solely on this is not advisable.

• Isolating and running code that deserializes in low privilege

environments when possible.

• Logging deserialization exceptions and failures, such as where the

incoming type is not the expected type, or the deserialization throws

exceptions.

• Restricting or monitoring incoming and outgoing network connectivity

from containers or servers that deserialize.

• Monitoring deserialization, alerting if a user deserializes constantly.

Thank you for your time ☺

More write up will come soon

Read Entire Article