Deserialization vulnerability

[Nytro]

Table of Contents
Serialization (marshaling): ............................................................................................................................ 4 Deserialization (unmarshaling): .................................................................................................................... 4
Programming language support serialization: ............................................................................................... 4
Risk for using serialization: .......................................................................................................................... 5
Serialization in Java ...................................................................................................................................... 6
Deserialization vulnerability in Java: ............................................................................................................ 6
Code flow work........................................................................................................................................... 11
Vulnerability Detection: .............................................................................................................................. 12
CVE: ........................................................................................................................................................... 17
Tools: .......................................................................................................................................................... 17
Vulnerable libraries lead to RCE: ............................................................................................................... 18
Mitigation: .................................................................................................................................................. 19
Serialization in Python ................................................................................................................................ 20
Deserialization vulnerability in Python: ..................................................................................................... 21
Pickle instructions ....................................................................................................................................... 25
Exploit vulnerability: .................................................................................................................................. 26
CVE: ........................................................................................................................................................... 29
Mitigation: .................................................................................................................................................. 29
Serialization in PHP .................................................................................................................................... 30
Deserialization vulnerability in PHP: ......................................................................................................... 30
Exploit vulnerability: .................................................................................................................................. 35
CVE: ........................................................................................................................................................... 39
Mitigation: .................................................................................................................................................. 40
Serialization in Ruby ................................................................................................................................... 41
Deserialization vulnerability in Ruby: ........................................................................................................ 42
Detect and exploit vulnerability: ................................................................................................................ 44
CVE: ........................................................................................................................................................... 53
Tools: .......................................................................................................................................................... 53
Mitigation: .................................................................................................................................................. 53
Conclusion: ................................................................................................................................................. 56

Download: https://www.exploit-db.com/docs/english/44756-deserialization-vulnerability.pdf?rss