1

I need to parse untrusted Java serialized objects. The data is given to me as a byte array (written at some point by ObjectOutputStream).

I do not want to simply call ObjectInputStream.readObject() and/or load the actual object. I am looking for a way to safely parse the bytes and grab field names & values.

--

Here's a little summary of my attempt so far, after taking a look at the ObjectInputStream procedure for deserializing objects.

I have tried to extract field types/names (as unicode strings) recursively based on expected stream constants. I end up with a list of field names whose values should appear in the byte array in order. I am uneasy about this approach because it is probably buggy. Especially accommodating for what seems to be individual serialization protocols followed by HashMap, ArrayList, etc. But it might work, if I can figure out a way to read the bytes that represent field values:

I can try to read and store primitives based on size/offset, but when I encounter my first object, it gets a bit more complicated -- there is no clear way to distinguish between which bytes are associated with which values anymore (without actually loading the object in the way that ObjectInputStream probably does?).

--

Can anyone suggest either a potential solution that I'm obviously looking past, or a trusted library that can help parse the serialized data without loading objects?

Thank you for reading, and for all comments/suggestions!!! I apologize if something is unclear and I would be happy to clarify if you bear with me.

1 Answers1

2

You can't do this in principle. Any Java class can take over its own Serialization and write arbitrary data to the stream that only it knows how to parse and reconstruct, via code that is only invoked during deserialization.

user207421
  • 305,947
  • 44
  • 307
  • 483
  • 1
    Do you have any recommendations to the asker on how they might achieve the goal of reading some or all fields from untrusted serialized data without having to expose their application to deserialization-base exploitation? The examples section of https://www.owasp.org/index.php/Deserialization_of_untrusted_data has a perfectly good reason why doing this even with their own custom class is dangerous. I did a quick search and was unable to find any libraries for this, but I would have to guess someone else has had this same problem. – Jon Peterson Jul 07 '16 at 00:53
  • @JonPeterson My answer states that what the asker wants is impossible in principle. It is therefore impossible to provide a recommendation as how to do it. Surely this is obvious? – user207421 Jul 10 '16 at 00:31