How to test your web application for deserialization vulnerabilities

Deserialization vulnerabilities arise when an application rebuilds objects from attacker-influenced serialized data without restricting what can be constructed. Unsafe object deserialization can expose sensitive files, trigger server-side request forgery, or lead to remote code execution when dangerous type metadata reaches a vulnerable gadget chain. The weakness may sit in cookies, session tokens, hidden fields, SOAP messages, or an API request body.

A useful assessment combines code review, targeted dynamic testing, and operational monitoring rather than relying on a scanner alone. For Australian teams, that means aligning evidence with the Australian Signals Directorate’s Essential Eight and Australian Cyber Security Centre guidance. Infoziant Security brings vulnerability assessment, penetration testing, managed security, SIEM monitoring, and threat intelligence into one engagement model.

Map deserialization trust boundaries

Begin by mapping where serialized data enters the application and where it becomes executable objects. Identify frameworks, API gateways, message queues, background workers, and administrative interfaces involved in processing session state or object graphs. Distinguish trusted internal exchanges from externally reachable inputs.

Inventory the languages and formats in use. Java native serialization, .NET BinaryFormatter, Python pickle, and PHP object injection can be dangerous with untrusted input. JSON and XML are not automatically unsafe, but permissive type handling, polymorphic binding, or unsafe parser settings can introduce comparable risks.

Trace each source to its deserialization sink and record authentication requirements, available object types, and downstream effects. This map becomes the basis for test cases and helps distinguish a theoretical parser weakness from a reachable application vulnerability.

Build an authorised and controlled test plan

Define scope, rules of engagement, test accounts, time windows, and stop conditions before sending unusual requests. Replicate framework and dependency versions in staging where possible. Use synthetic records, disposable orders, and designated administrator accounts so that test activity cannot affect genuine customer transactions.

For a Sydney or Melbourne retailer, online baskets commonly contain payment tokens, delivery addresses, and loyalty details. Synthetic checkout data is safer than live customer records. Apply the same principle to banking, healthcare, and government applications, where availability and confidentiality are especially important.

Assess data-handling obligations under the Privacy Act 1988 and the Australian Privacy Principles. Keep test data minimised and protected, while coordinating with security operations and incident response teams. If live data shows signs of compromise, escalate the finding separately from routine vulnerability validation.

Validate unsafe object handling without harming operations

Exercise endpoints with benign variations in content type, schema, object type, and nesting depth. A DAST scanner, Burp Suite, or a language-specific test harness can help identify inconsistent error handling and suspicious object construction. Test malformed objects, oversized graphs, and unexpected fields, but avoid denial-of-service stress testing.

Use harmless, authorised markers to demonstrate attacker influence instead of attempting destructive actions. An approved mock collaborator can confirm an out-of-band callback without contacting third-party infrastructure. Keep request volumes low, use test-only records, and ensure that any file access or process activity remains within the agreed scope.

Collect evidence from application logs, SIEM alerts, DNS and HTTP records, file-access events, and process telemetry. Unexpected outbound connections, new child processes, or malformed-object errors can strengthen a finding. Record request identifiers and timestamps so defenders can reproduce the result without exposing sensitive payloads.

Prioritise root causes over perimeter workarounds

Assess whether each issue provides only object manipulation or also reaches code execution, data access, or internal services. Do not assume every deserialization weakness grants full system access. Trace reachable gadget chains through application code and dependencies, then rank findings by demonstrated impact and exposure.

Replace unsafe deserializers, restrict accepted types, remove dangerous library versions, and validate input before reconstruction. Where serialized objects carry trusted state, use HMAC signatures, keep keys outside application code, rotate them, and compare signatures in constant time. Encryption alone does not provide this integrity protection.

Defence in depth remains valuable. Cloud and mobile security assessments, infrastructure audits, least-privilege service accounts, and egress restrictions can limit exploitation. Administrators can review firewall reset steps as part of a documented rollback check, but perimeter changes do not repair unsafe application code.

Turn findings into remediation priorities and a retest

A useful report connects each technical finding to affected assets, realistic attack paths, business impact, and accountable owners. Prioritise exposed internet-facing systems, sensitive data flows, and weaknesses with a credible path to code execution.

• Replace dangerous deserialization formats and remove or isolate gadget-bearing dependencies from production images.
• Allowlist expected classes and schemas, reject unknown types, and enforce size and nesting limits.
• Protect trusted serialized objects with HMAC signatures, managed secrets, key rotation, and strict verification.
• Add deserialization-focused SAST, dependency scanning, and carefully configured dynamic testing to CI/CD pipelines.
• Correlate malformed-object errors, unexpected callbacks, and abnormal process activity through SIEM monitoring and incident runbooks.

Contact Infoziant Security to scope a penetration test or trial engagement, request a free VAPT report, and agree on remediation deadlines and a retest.