Deserialization in Java - is there still anything to fear?
summary
The talk examines Java deserialization vulnerabilities: which unsafe deserialization patterns still pose risks in 2020, which attack vectors have been mitigated, and how to distinguish false positives from real issues in modern testing. It explains concrete defenses and remaining exploit techniques, discusses gadget chains that still reliably work, and describes newer combined attack vectors that can still achieve remote code execution.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 7:11Java serialization basics
- 12:31Serialization tool in practice
- 23:50Deserialization vulnerability demo
- 31:23Protecting against dangerous deserialization
- 35:18Summary
related talks
41mJava Serialisation: A Modern Fairytale
47mA Modern Fairy Tale: Java Serialization
35mHow To Find The Next Great Deserialization CVE
56mThe Anatomy of Java Vulnerabilities
49mThe Anatomy of Java Vulnerabilities
40m[In]secure Deserialization, And How [Not] To Do It
35mDangerous Serialization
34mDeserialization: what, how and why [not]