Insecure Deserialization

Summary

Exploiting an application's process of converting serialized data back into objects — attackers can craft malicious serialized data leading to remote code execution in vulnerable systems.

• 1Read a conceptual explanation of how insecure deserialization can lead to code execution.
• 2Learn why this vulnerability is language and framework-specific in its exact exploitation technique.
• 3Understand the general defense: avoid deserializing untrusted data, or use safe serialization formats.