Unusual Java Deserialization

Java is an object-oriented programming language that enables applications to interact with objects and run commands. To easily store or share Java objects between applications, objects are converted into a byte sequence, which is called serialization. After receiving serialized data, the application reconstructs the objects from the byte sequence, which is called deserialization.

Applications are able to run commands from serialized data because the serialization process maintains the runtime state of each object and deserialization maintains the order of objects. Malicious attacks inject objects in between connected objects, creating a new, manipulated order of objects called a gadget chain.

Deserialization vulnerabilities in Java applications, combined with applications that trust user-provided data, can enable an attacker to inject objects into a gadget chain that run malicious commands. For example, an attacker-controlled client and server exchange serialized data over HTTP (1). The attacker creates a payload with manipulated serialized data that injects an object with a malicious command into a gadget chain (2). After receiving the malicious payload, the server reconstructs the object and runs the malicious commands in the runtime command prompt.