Are you facing problems with insecure deserialization? Do you wish you had a way to anticipate and protect yourself against issues like insecure deserialization? Then this article is the answers to your questions. Today, we are going to look at the OWASP Top 10 and how it can help you protect your software. We will then look specifically at insecure deserialization and how to protect yourself from it.
The Open Web Application Security Project (OWASP) is an organization that is built to improve the security of software.
Created yearly by OWASP, the OWASP Top 10 is a ranked list of the top 10 web application security risks. There are other security risks, but these top 10 risks tell a web developer where to focus when dealing with security risks.
Now, let us dive into the eighth OWASP Top 10 security risk, insecure deserialization, and how to protect your application against it.
Serialization and Deserialization
Serialization in web applications is the conversion of objects in a particular programming languages into byte streams, which can then be accepted by any other programming language or stored in a database.
These byte streams that have been sent must then be converted back into objects in order to be accepted by a programming language or stored in a database. This is called deserialization.
Deserialization attacks happen when untrusted data is input without any validation, and such data is allowed to be deserialized. These attacks give the attacker unrestricted access to input harmful code. In short, insecure deserialization makes your software vulnerable to remote code execution.
Some Deserialization Attack Scenarios
- Assume you have a web application built with AngularJS called Spring Boot API. To transmit data from the front-end (AngularJS) to the back-end (Spring Boot API), we first serialize the data and pass it back and forth with each request. If the data isn’t validated or checked properly and the attacker finds the “R00” Java object signature, they can use the Java Serial Killer tool to execute remote code in the API.
- As another scenario, let’s say you have a Django blog application that stores cookies containing the userID, role, and username of a user, John. If John logs in and has his own cookies store, he can alter the cookie and input some malicious code to do some damage. If there is no data validation, attackers can use malicious code to alter the role to give themselves admin privileges, which would be a tremendous problem.
Guide to Protecting Against Insecure Deserialization
1. Validate User Input:
Validating user input will help ensure that only properly formatted data is accepted by the form and potentially stored in the database. Data from any user input should always have a validation system. Users can input data in a software through forms and cookies, and any input other than what is expected in the form should not be accepted.
2. Avoid Deserializing Objects from Untrusted Sources:
Here, ‘untrusted sources’ refers to users of your software who are not authenticated.
When building a software, you must always consider increasing security by restricting data access to authenticated users only. Letting only authenticated users access your software can help reduce the risk of having your software attacked by users. This is not to say authenticated users can not attack your system. But if a user is authenticated, you have enough data to track where the attack is coming from. You could possibly take legal actions against the attacker as well. This is a great start to protecting your application from malicious attackers because it is easy to implement.
3. Employ Tools That Find and Fix Security Vulnerabilities:
While the steps that need to be taken to secure your system are crucial to your application’s success, they are also time-consuming and tedious. Employing tools that take on the responsibilities of securing your application can help ease this burden.
One such useful tool, especially against deserialization attacks, is Klocwork – a free tool that provides static code analysis to find and fix security vulnerabilities in C, C++, C#, Java, and JavaScript. The tool operates in compliance with most international security standards and international data security laws, so using Klocwork takes care of much of your security needs and legal obligations.
4. Verification of Serialized Object:
To do this, you can make sure users meet certain criteria before you serialize objects gotten from them.
You should also implement integrity constraints. Integrity constraints are used to ensure the quality of the object to be serialized. Using digital signatures is a mathematical process for verifying the authenticity of digital messages or documents. Adding valid digital signatures where the constraints are met tells the software that the serialized data is trusted and is sent from an authenticated user.
5. Deserialization Monitoring:
Monitoring is a continuous process, so most times, it is usually outsourced to external tools. Deserialization monitoring involves checking for users who are trying to send requests for object deserialization repeatedly within a short period. The user is most likely trying to cause some damage or breach the security of the software.
Sometimes developers build systems that alert them about any repeated deserialization alongside the software. With the alerts, developers can easily know where the breach is occurring, and the user can be temporarily blocked.
6. Encryption of Serialized Object:
Encryption has to do with the process of encoding data. Using this, one can encode all the serialized objects. If objects are passed as it is through the network, an attacker can easily intercept the object in transit and send their own malicious object to the server. When the object is encrypted, only the authenticated user and the server can access the object, which is much safer.
In this article, we covered insecure deserialization and how to protect your software from such attacks. We’ve examined the importance of protecting your software against security vulnerabilities and discussed the need for comprehensive security monitoring .
Make sure you check out the different methods mentioned for protecting your system and see what tools are out there that can help you create a more secure and robust web application.
