CWE-502: Deserialization of Untrusted Data (Base)

Description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Extended Description: It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption. Data that is untrusted can not be trusted to be well-formed. When developers place no restrictions on gadget chains, or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.

Background Details: ::Serialization and deserialization refer to the process of taking program-internal object-related data, packaging it in a way that allows the data to be externally stored or transferred (serialization), then extracting the serialized data to reconstruct the original object (deserialization).::

Alternate Terms: ::TERM:Marshaling, Unmarshaling:DESCRIPTION:Marshaling and unmarshaling are effectively synonyms for serialization and deserialization, respectively.::TERM:Pickling, Unpickling:DESCRIPTION:In Python, the pickle functionality is used to perform serialization and deserialization.::TERM:PHP Object Injection:DESCRIPTION:Some PHP application researchers use this term when attacking unsafe use of the unserialize() function; but it is also used for CWE-915.::

Applicable Platforms: ::LANGUAGE NAME:Java:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Ruby:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:PHP:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:Python:LANGUAGE PREVALENCE:Undetermined::LANGUAGE NAME:JavaScript:LANGUAGE PREVALENCE:Undetermined::TECHNOLOGY CLASS:ICS/OT:TECHNOLOGY PREVALENCE:Often::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:OMISSION: This weakness is caused by missing a security tactic during the architecture and design phase.::PHASE:Implementation::



Common Consequences: ::SCOPE:Integrity:IMPACT:Modify Application Data:IMPACT:Unexpected State:NOTE:Attackers can modify unexpected objects or data that was assumed to be safe from modification.::SCOPE:Availability:IMPACT:DoS: Resource Consumption (CPU):NOTE:If a function is making an assumption on when to terminate, based on a sentry in a string, it could easily never terminate.::SCOPE:Other:IMPACT:Varies by Context:NOTE:The consequences can vary widely, because it depends on which objects or methods are being deserialized, and how they are used. Making an assumption that the code in the deserialized object is valid is dangerous and can enable exploitation.::

Detection Methods: ::METHOD:Automated Static Analysis:DESCRIPTION:Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect sources (origins of input) with sinks (destinations where the data interacts with external components, a lower layer such as the OS, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design Implementation:DESCRIPTION:If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.::PHASE:Implementation:DESCRIPTION:When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.::PHASE:Implementation:DESCRIPTION:Explicitly define a final object() to prevent deserialization.::PHASE:Architecture and Design Implementation:DESCRIPTION:Make fields transient to protect them from deserialization. An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.::PHASE:Implementation:DESCRIPTION:Avoid having unnecessary types or gadgets available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.::

Observed Examples: ::REFERENCE:CVE-2019-12799:DESCRIPTION:chain: bypass of untrusted deserialization issue (CWE-502) by using an assumed-trusted class (CWE-183):LINK:https://www.cve.org/CVERecord?id=CVE-2019-12799::REFERENCE:CVE-2015-8103:DESCRIPTION:Deserialization issue in commonly-used Java library allows remote execution.:LINK:https://www.cve.org/CVERecord?id=CVE-2015-8103::REFERENCE:CVE-2015-4852:DESCRIPTION:Deserialization issue in commonly-used Java library allows remote execution.:LINK:https://www.cve.org/CVERecord?id=CVE-2015-4852::REFERENCE:CVE-2013-1465:DESCRIPTION:Use of PHP unserialize function on untrusted input allows attacker to modify application configuration.:LINK:https://www.cve.org/CVERecord?id=CVE-2013-1465::REFERENCE:CVE-2012-3527:DESCRIPTION:Use of PHP unserialize function on untrusted input in content management system might allow code execution.:LINK:https://www.cve.org/CVERecord?id=CVE-2012-3527::REFERENCE:CVE-2012-0911:DESCRIPTION:Use of PHP unserialize function on untrusted input in content management system allows code execution using a crafted cookie value.:LINK:https://www.cve.org/CVERecord?id=CVE-2012-0911::REFERENCE:CVE-2012-0911:DESCRIPTION:Content management system written in PHP allows unserialize of arbitrary objects, possibly allowing code execution.:LINK:https://www.cve.org/CVERecord?id=CVE-2012-0911::REFERENCE:CVE-2011-2520:DESCRIPTION:Python script allows local users to execute code via pickled data.:LINK:https://www.cve.org/CVERecord?id=CVE-2011-2520::REFERENCE:CVE-2012-4406:DESCRIPTION:Unsafe deserialization using pickle in a Python script.:LINK:https://www.cve.org/CVERecord?id=CVE-2012-4406::REFERENCE:CVE-2003-0791:DESCRIPTION:Web browser allows execution of native methods via a crafted string to a JavaScript function that deserializes the string.:LINK:https://www.cve.org/CVERecord?id=CVE-2003-0791::



Notes: ::TYPE:Maintenance:NOTE:The relationships between CWE-502 and CWE-915 need further exploration. CWE-915 is more narrowly scoped to object modification, and is not necessarily used for deserialization.::