Deserializing an object from untrusted input may result in security problems, such as denial of service or remote code execution.
++Note that a deserialization method is only dangerous if it can instantiate +arbitrary classes. Serialization frameworks that use a schema to instantiate +only expected, predefined types are generally not tracked by this query. Such +frameworks are generally safe with respect to arbitrary-class-instantiation and +gadget-chain attacks when the schema is trusted and does not permit +user-controlled type resolution. However, care must be taken to ensure the schema +strictly limits the allowed types. Permitting common standard library classes +can still leave the application vulnerable to gadget-chain attacks. +
+Deserializing an object from untrusted input may result in security problems, such as denial of service or remote code execution.
++Note that a deserialization method is only dangerous if it can instantiate +arbitrary classes. Serialization frameworks that use a schema to instantiate +only expected, predefined types are generally not tracked by this query. Such +frameworks are generally safe with respect to arbitrary-class-instantiation and +gadget-chain attacks when the schema is trusted and does not permit +user-controlled type resolution. However, care must be taken to ensure the schema +strictly limits the allowed types. Permitting common standard library classes +can still leave the application vulnerable to gadget-chain attacks. +
+Deserializing untrusted data using any deserialization framework that allows the construction of arbitrary serializable objects is easily exploitable -and in many cases allows an attacker to execute arbitrary code. Even before a +and in many cases allows an attacker to execute arbitrary code. Even before a deserialized object is returned to the caller of a deserialization method a lot of code may have been executed, including static initializers, constructors, -and finalizers. Automatic deserialization of fields means that an attacker may +and finalizers. Automatic deserialization of fields means that an attacker may craft a nested combination of objects on which the executed initialization code may have unforeseen effects, such as the execution of arbitrary code.
-There are many different serialization frameworks. This query currently
+There are many different serialization frameworks. This query currently
supports Kryo, XmlDecoder, XStream, SnakeYaml, JYaml, JsonIO, YAMLBeans, HessianBurlap, Castor, Burlap,
Jackson, Jabsorb, Jodd JSON, Flexjson, Gson, JMS, and Java IO serialization through
ObjectInputStream/ObjectOutputStream.
+Note that a deserialization method is only dangerous if it can instantiate +arbitrary classes. Serialization frameworks that use a schema to instantiate +only expected, predefined types are generally not tracked by this query. For +example, Apache Avro's deserialization methods follow a schema and are +therefore generally safe with respect to arbitrary-class-instantiation and +gadget-chain attacks when the schema is trusted and does not permit +user-controlled type resolution. However, care must be taken to ensure the schema +strictly limits the allowed types. Permitting common standard library classes +can still leave the application vulnerable to gadget-chain attacks. +
-Avoid deserialization of untrusted data if at all possible. If the +Avoid deserialization of untrusted data if at all possible. If the architecture permits it then use other formats instead of serialized objects, -for example JSON or XML. However, these formats should not be deserialized +for example JSON or XML. However, these formats should not be deserialized into complex objects because this provides further opportunities for attack. For example, XML-based deserialization attacks are possible through libraries such as XStream and XmlDecoder. @@ -43,7 +54,7 @@ Recommendations specific to particular frameworks supported by this query:
com.alibaba.fastjson.parser.ParserConfig#setSafeMode with the argument true before deserializing untrusted data.FasterXML - com.fasterxml.jackson.core:jackson-databind
FasterXML - com.fasterxml.jackson.core:jackson-databind
com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping and don't annotate any object fields with com.fasterxml.jackson.annotation.JsonTypeInfo passing either the CLASS or MINIMAL_CLASS values to the annotation.
@@ -56,16 +67,16 @@ Recommendations specific to particular frameworks supported by this query:
com.esotericsoftware.kryo(5).Kryo#setRegistrationRequired with the argument false on any Kryo instance that may deserialize untrusted data.ObjectInputStream - Java Standard Library
ObjectInputStream - Java Standard Library
org.apache.commons.io.serialization.ValidatingObjectInputStream.org.apache.commons.io.serialization.ValidatingObjectInputStream.SnakeYAML - org.yaml:snakeyaml
org.yaml.snakeyaml.constructor.SafeConstructor to org.yaml.snakeyaml.Yaml's constructor before using it to deserialize untrusted data.org.yaml.snakeyaml.constructor.SafeConstructor to org.yaml.snakeyaml.Yaml's constructor before using it to deserialize untrusted data.XML Decoder - Standard Java Library
Deserializing untrusted data using any deserialization framework that allows the construction of arbitrary serializable objects is easily exploitable -and in many cases allows an attacker to execute arbitrary code. Even before a +and in many cases allows an attacker to execute arbitrary code. Even before a deserialized object is returned to the caller of a deserialization method a lot of code may have been executed, including static initializers, constructors, -and finalizers. Automatic deserialization of fields means that an attacker may +and finalizers. Automatic deserialization of fields means that an attacker may craft a nested combination of objects on which the executed initialization code may have unforeseen effects, such as the execution of arbitrary code.
-There are many different serialization frameworks. This query currently +There are many different serialization frameworks. This query currently supports Pickle, Marshal and Yaml.
++Note that a deserialization method is only dangerous if it can instantiate +arbitrary classes. Serialization frameworks that use a schema to instantiate +only expected, predefined types are generally not tracked by this query. Such +frameworks are generally safe with respect to arbitrary-class-instantiation and +gadget-chain attacks when the schema is trusted and does not permit +user-controlled type resolution. However, care must be taken to ensure the schema +strictly limits the allowed types. Permitting common standard library classes +can still leave the application vulnerable to gadget-chain attacks. +
-Avoid deserialization of untrusted data if at all possible. If the +Avoid deserialization of untrusted data if at all possible. If the architecture permits it then use other formats instead of serialized objects, for example JSON.
diff --git a/ruby/ql/src/queries/security/cwe-502/UnsafeDeserialization.qhelp b/ruby/ql/src/queries/security/cwe-502/UnsafeDeserialization.qhelp index b84c7dce0677..001f7ef1448c 100644 --- a/ruby/ql/src/queries/security/cwe-502/UnsafeDeserialization.qhelp +++ b/ruby/ql/src/queries/security/cwe-502/UnsafeDeserialization.qhelp @@ -7,6 +7,16 @@ Deserializing untrusted data using any method that allows the construction of arbitrary objects is easily exploitable and, in many cases, allows an attacker to execute arbitrary code. ++Note that a deserialization method is only dangerous if it can instantiate +arbitrary classes or objects. Serialization frameworks that use a schema to instantiate +only expected, predefined types are generally not tracked by this query. Such +frameworks are generally safe with respect to arbitrary-class-instantiation and +gadget-chain attacks when the schema is trusted and does not permit +user-controlled type resolution. However, care must be taken to ensure the schema +strictly limits the allowed types. Permitting common standard library classes +can still leave the application vulnerable to gadget-chain attacks. +
ox gem,
do not use parse_obj and load using the non-default :object mode.
Instead use the load method in the default mode or better explicitly set a safe
-mode such as :hash.
+mode such as :hash.