Weakness (CWE)
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
How to prevent it (7 mitigations)
-
Architecture and Design, Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
-
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
-
Implementation
Explicitly define a final object() to prevent deserialization.
-
Architecture and Design, Implementation
Make fields transient to protect them from deserialization.
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
-
Implementation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
-
Architecture and Design, Implementation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-502
1,213 results · Clear filters · Feed
-
Critical 9.8
An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remo…
-
Critical 9.8
WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
-
Critical 9.8
WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.
-
Critical 9.8
WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
-
Critical 9.8
WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
-
Critical 9.8
WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it possible for un…
-
Critical 9.2
Critical Remote Code Execution (RCE) vulnerability reported in Windchill
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.
-
Critical 10.0
Microsoft Entra ID Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
-
Critical 9.8
WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
-
Critical 9.8
WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.
-
Critical 9.8
LMDeploy Remote Code Execution via Unsafe Pickle Deserialization in the Disaggregated Serving Peer Connector
LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loa…
-
Critical 9.1
Remote Code Execution (RCE) through Deserialization of Untrusted Data in Splunk MCP Server app
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management c…
-
Critical 9.8
WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
-
Critical 9.8
WordPress Flexible Subscriptions plugin <= 1.8.1 - PHP Object Injection vulnerability
Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.
-
Critical 9.8
Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization refer…
-
Critical 9.8
WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
-
Critical 9.8
WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
-
Critical 9.8
WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
-
Critical 9.8
WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
-
Critical 9.8
WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
-
Critical 9.8
WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
-
Critical 9.8
Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection
The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8.5 via deserialization of untrusted input from form submissions. This makes it possible for unaut…
-
Critical 9.8
WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
-
Critical 9.8
Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026
A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.
-
Critical 9.9
Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server
A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary cod…
-
Critical 9.8
Apache Fory: Heap type confusion in C++ polymorphic smart-pointer deserialization
Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing …
-
Critical 9.1
Apache Fory: Out-of-bounds heap read in C++ struct deserializer tagged-int fast-path
Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap re…
-
Critical 9.8
Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPr…
-
Critical 9.9
Azure Service Bus Remote Code Execution Vulnerability
Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
-
Critical 9.8
WordPress AI ANN theme <= 1.29.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.
-
Critical 9.8
WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
-
Critical 9.8
WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.
-
Critical 9.8
WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.
-
Critical 9.8
WordPress Accalia theme <= 1.5.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.
-
Critical 9.8
WordPress Adrena theme <= 1.2.14 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.
-
Critical 9.8
WordPress Abogado theme <= 1.18 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
-
Critical 9.8
WordPress A.Williams theme <= 1.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
-
Critical 9.8
WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.