Marshalling Pickles

Frohoff, C., & Lawrence, G. (2015). Marshalling Pickles: How Deserializing Objects Will Ruin Your Day.

Type

Conference paper

Intellectual base

Primary research

Year

2015

Link

no authoritative link yet

Cited by

1 citation across 1 artifact.

Each citation links to the sentence it supports in the citing article.

Domain-specific

• Insecure Deserialization
  • Java's ObjectInputStream.readObject traverses the object graph encoded in the byte stream, calling constructors, readObject overrides, and readResolve methods on every object it instantiates; an attacker-controlled byte stream can arrange a graph of classes present in the JVM's classpath whose constructors and callbacks, chained together, perform arbitrary computation — the ysoserial-style payload families exploit Commons-Collections InvokerTransformer chains, the Spring Beans/Core gadget packaged as ysoserial's Spring1 payload, and other classpath-present gadget sequences

    This sourceFrohoff & Lawrence, AppSecCali 2015, establishing the ObjectInputStream callback-graph mechanism and the Commons-Collections InvokerTransformer gadget chain; the Spring Beans/Core chain named on the same sentence is ysoserial's `Spring1` payload, authored by Frohoff and shipped in the tool released with this talk, so it belongs to this work rather than postdating it. What no source cited here enumerates is the open-ended "other classpath-present gadget sequences". Frohoff & Lawrence, AppSecCali 2015 (Marshalling Pickles), the talk that demonstrated the ObjectInputStream/Commons-Collections gadget chain. The talk circulates under two subtitles — "How Deserializing Objects Will Ruin Your Day" and "...Can Ruin Your Day"; the form given above is one of them.

    Supported in partVerified against the source

    Read by an automated reader; not a human review. How support was checked

Verification

Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.

Does it back the claim? Read against the text for 1 of 1 citation: 1 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.

Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.

See how references were verified.

Registry ID ref:e4b4828f0b24 · see in the full table