Which term describes the act of deserializing malicious serialized content along with injected code, compromising the system?

Which term describes the act of deserializing malicious serialized content along with injected code, compromising the system?

• A. Insecure deserialization
• B. Deserialization
• C. Unvalidated Redirects and Forwards
• D. Cookie poisoning attack

Answer: (A)

Insecure deserialization describes what happens when an application deserializes data from an untrusted source, and that data is crafted to include injected code or objects. When the deserialized payload is processed, it can trigger unintended behavior, such as remote code execution, data tampering, or privilege escalation, leading to a full system compromise. Plain deserialization is just the act of turning serialized bytes back into objects; it becomes a vulnerability only when the source is not trusted and the process lacks safeguards. The other options don’t fit this scenario: redirects/forwards are about navigation flow, and cookie manipulation involves altering stored values rather than executing injected code via deserialization. Mitigation focuses on not deserializing untrusted data, adding integrity checks or signatures, restricting which classes can be instantiated, and using safer serialization formats.

Insecure deserialization describes what happens when an application deserializes data from an untrusted source, and that data is crafted to include injected code or objects. When the deserialized payload is processed, it can trigger unintended behavior, such as remote code execution, data tampering, or privilege escalation, leading to a full system compromise. Plain deserialization is just the act of turning serialized bytes back into objects; it becomes a vulnerability only when the source is not trusted and the process lacks safeguards. The other options don’t fit this scenario: redirects/forwards are about navigation flow, and cookie manipulation involves altering stored values rather than executing injected code via deserialization. Mitigation focuses on not deserializing untrusted data, adding integrity checks or signatures, restricting which classes can be instantiated, and using safer serialization formats.