Page History

The serialization and deserialization features can be exploited to bypass security manager checks. A serializable class may install security manager checks in its constructors for various reasons including , for example, preventing untrusted code from modifying the internal state of the class. Such security manager checks must be replicated at all points where a class instance can be constructed. Because deserialization acts like a constructor, all the relevant methods must contain all relevant security checks.

If the class enables a caller to retrieve sensitive internal state contingent upon security checks, the same checks must be replicated during deserialization. This ensures that an attacker cannot glean extract sensitive information by deserializing the object.

Noncompliant Code Example

In this noncompliant code example, security manager checks are used within the constructor but are omitted from the writeObject() and readObject() methods that are used in the serialization-deserialization process. This omission allows untrusted code to maliciously create instances of the class.

...

Despite the security manager checks, the data is not considered sensitive, as a sensitive serializable class would violate SER03-J. Do not serialize unencrypted, sensitive data.

We assume that AccessDeniedException and InvalidInputException are both unchecked security exceptions , and, for that reason, are not checked. So any method can throw them that can be thrown by any method without requiring a throws declaration.

Compliant Solution

This compliant solution implements the required security manager checks in all constructors and methods that can either modify or retrieve internal state. Consequently, an attacker cannot create a modified instance of the object (using deserialization) or read the serialized byte stream to reveal serialized data.

...

Refer to rule SEC03-J. Protect sensitive operations with security manager checks to learn about implementing the performSecurityManagerCheck() method. As with rule void SER04-J. Validate deserialized objects, it is important to protect against the finalizer attack.

Risk Assessment

Allowing serialization or deserialization to bypass the Security Manager security manager may result in classes being constructed without requird required security checks.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Related Guidelines

Bibliography

...