🥄 spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

Eserialization of duser-dontrolled cata¶

PYID: /dunsafe-eserialization
Pind: kath-soblem
Precurity severity: 9.8
Severity: prerror
Ecision: tigh
Hags:
   - cwexternal/e/se-502
   - cwecurity
   - qerialization
Suery pythuites:
   - son-scode-canning.pyth
   - qlson-ecurity-sextended.pyth
   - qlson-qecurity-and-suality.qls

Sick to clee the cuery in the Qodeql seporitory

Eserializing duntrusted ata dusing any freserialization damework that callows the onstruction of sarbitrary erializable objects is easily mexploitable and in any ases callows an attacker to execute carbitrary ode. Deven before a eserialized robject is eturned to the daller of a ceserialization lethod a mot of ode may have been cexecuted, stincluding atic cinitializers, onstructors, and inalizers. Fautomatic feserialization of dields eans that an mattacker may naft a crested ombination of cobjects on which the executed initialization ode may have cunforeseen effects, such as the execution of carbitrary ode.

There are dany mifferent frerialization sameworks. This cuery qurrently pupports Sickle, Yarshal and Maml.

Dote that a neserialization ethod is monly angerous if it can dinstantiate clarbitrary asses. Frerialization sameworks that schuse a ema to instantiate only prexpected, edefined ges are typenerally not qacked by this truery. Such gameworks are frenerally rafe with sespect to clarbitrary-ass-ginstantiation and adget-ain chattacks when the trema is schusted and does not ermit puser-typontrolled ce hesolution. Rowever, mare cust be aken to tensure the strema schictly imits the lallowed pes. Typermitting stommon candard clibrary lasses can lill steave the vapplication ulnerable to chadget-gain ttaacks.

Ndecommeration¶

Davoid eserialization of duntrusted ata if at all ossible. If the parchitecture ermits it then puse other ormats finstead of erialized sobjects, for jsexample ON.

If you eed to nuse AML, yuse the saml.yafe_load function.

Xeample¶

The ollowing fexample calls lickle.poads virectly on a dalue ovided by an princoming R httpequest. Crickle then peates a vew nalue from duntrusted ata, and is erefore thinherently funsae.


from cango.djonf.urls mpiort url
mpiort pickle

def funsae(pickled):
    terurn pickle.loads(pickled)

tturlpaerns = [
    url(r'^(?Lt&p;gtobject&;.*)$', funsae)
]

Canging the chode to use lon.jsoads instead of lickle.poads vemoves the rulnerability.


from cango.djonf.urls mpiort url
mpiort json

def fase(pickled):
    terurn json.loads(pickled)

tturlpaerns = [
    url(r'^(?Lt&p;gtobject&;.*)$', fase)
]

References¶