CME-1319
Deserialization Type Allowlisting
Description
Prevention of deserialization attacks through type allowlisting, signature verification of serialized data, and use of safe deserialization libraries. Restricts deserialization to explicitly allowed classes and validates object graphs before reconstruction. Applies to Java (ObjectInputStream with ObjectInputFilter), Python (restricted pickle with custom Unpickler), .NET (DataContractSerializer, avoiding BinaryFormatter), Ruby (safe Marshal alternatives), and PHP (JSON over unserialize). Prevents remote code execution via crafted serialized payloads by blocking gadget chain instantiation.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Requires object injection AND gadget chain AND type allowlist bypass; allowlisting blocks known gadgets |
| Integrity (I) | H → L | Prevents RCE from deserialization by blocking instantiation of dangerous classes |
| Confidentiality (C) | H → L | Prevents data extraction via deserialization side effects; type restrictions limit object graph |
CWE Relationships
Verification
Code review for type allowlisting and safe deserialization patterns
$ grep -r 'ObjectInputStream' /path/to/app | grep -E '(setObjectInputFilter|ObjectInputFilter\.Config)'
# Expected: All ObjectInputStream uses have filter configured
# Expected: All ObjectInputStream uses have filter configured
Platform: any
$ grep -r 'pickle\.loads' /path/to/app | grep -v 'Unpickler.*find_class'
# Expected: No unsafe pickle.loads calls (all use restricted Unpickler)
# Expected: No unsafe pickle.loads calls (all use restricted Unpickler)
Platform: any
$ grep -r 'BinaryFormatter' /path/to/app
# Expected: No BinaryFormatter usage (insecure, use DataContractSerializer)
# Expected: No BinaryFormatter usage (insecure, use DataContractSerializer)
Platform: any
$ grep -r 'unserialize' /path/to/app | grep -v 'json_decode'
# Expected: No PHP unserialize on untrusted data (use JSON)
# Expected: No PHP unserialize on untrusted data (use JSON)
Platform: any
$ semgrep --config 'r/java.lang.security.audit.object-deserialization' /path/to/app
# Expected: No deserialization findings
# Expected: No deserialization findings
Platform: any