Insecure Deserialization.

When an application converts serialized data (Java/PHP/Python/.NET binary formats, YAML, or JSON with type metadata) back into objects, the deserialiser may invoke constructors, magic methods, or gadget chains — sequences of already-loaded methods that, strung together, reach a dangerous sink such as Runtime.exec. With untrusted input an attacker crafts a payload that triggers this behaviour during deserialisation, yielding remote code execution (RCE), authentication bypass, file write, or denial of service.

The canonical case is CVE-2015-4852: Oracle WebLogic unsafely deserialised unauthenticated Java objects sent over the T3 protocol to TCP 7001, and with Apache Commons Collections on the classpath the ysoserial tool produced a working RCE gadget. Oracle's first patch used a fragile deny-list of classes rather than blocking untrusted deserialisation outright. Similar flaws hit Apache Struts (CVE-2017-9805, via XStream) and countless PHP unserialize() object-injection bugs. In OWASP's list the category moved from A8:2017 into the broader A08:2021 – Software and Data Integrity Failures.

flowchart LR
  A[Attacker] -->|crafted serialized blob<br/>cookie / T3 / API body| APP[Application]
  APP -->|deserialise untrusted bytes| DZ[Deserialiser]
  DZ -->|instantiate objects<br/>invoke magic methods| GC[Gadget chain<br/>on classpath]
  GC -->|reach dangerous sink| RCE[Runtime.exec / file write]
  APP -. defence .-> SIG[Signed payload +<br/>type allow-list]
  SIG -.->|reject unknown types| DROP[Drop]

Defences: never deserialise untrusted data; prefer schema-bound formats (plain JSON, Protobuf) with no type recovery; sign or HMAC serialized payloads; enforce a strict allow-list of deserialisable types; and keep runtimes patched — modern .NET has obsoleted and removed BinaryFormatter.