Marshalling Pickles

Frohoff, C., & Lawrence, G. (2015). Marshalling Pickles: How Deserializing Objects Will Ruin Your Day.

Type

Conference paper

Intellectual base

Primary research

Year

2015

Link

no authoritative link yet

Cited by

1 citation across 1 artifact.

Each citation links to the sentence it supports in the citing article.

Domain-specific

• Insecure Deserialization
  • Java's ObjectInputStream.readObject traverses the object graph encoded in the byte stream, calling constructors, readObject overrides, and readResolve methods on every object it instantiates; an attacker-controlled byte stream can arrange a graph of classes present in the JVM's classpath whose constructors and callbacks, chained together, perform arbitrary computation — the ysoserial-style payload families exploit Commons-Collections InvokerTransformer chains, the Spring Beans/Core gadget packaged as ysoserial's Spring1 payload, and other classpath-present gadget sequences

    This sourceFrohoff & Lawrence, AppSecCali 2015, establishing the ObjectInputStream callback-graph mechanism and the Commons-Collections InvokerTransformer gadget chain; the Spring Beans/Core chain named on the same sentence is ysoserial's `Spring1` payload, authored by Frohoff and shipped in the tool released with this talk, so it belongs to this work rather than postdating it. What no source cited here enumerates is the open-ended "other classpath-present gadget sequences". Frohoff & Lawrence, AppSecCali 2015 (Marshalling Pickles), the talk that demonstrated the ObjectInputStream/Commons-Collections gadget chain. The talk circulates under two subtitles — "How Deserializing Objects Will Ruin Your Day" and "...Can Ruin Your Day"; the form given above is one of them.

Verification

This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.

Registry ID ref:e4b4828f0b24 · see in the full table