SER03-J. Do not serialize sensitive data

Object serialization allows an object's state to be saved as a sequence of bytes and then reconstituted at a later time. Default serialization lacks protection for data that has been serialized. An attacker who gains access to the serialized data can use it to discover sensitive data, to determine implementation details of the objects, and for many other purposes. Similarly, an attacker can modify the serialized data in an attempt to compromise the system when the malicious data is deserialized. Consequently, sensitive data that is serialized is potentially exposed, without regard to the access qualifiers (such as the private keyword) that were used in the original code. Moreover, the security manager lacks checks that could guarantee integrity of the serialized data.

Examples of sensitive data that should remain unserialized include cryptographic keys, digital certificates, and classes that may hold references to sensitive data at the time of serialization.

Noncompliant Code Example

The data members of class Point are declared as private. The saveState() and readState() methods are used for serialization and de-serialization respectively. If the coordinates were sensitive (as we assume for this example), their presence in the data stream exposes them to malicious tampering.

public class Point {
  private double x;
  private double y;

  public Point(double x, double y) {
    this.x = x;
    this.y = y;
  }

  public Point() {
    // No argument constructor
  }
}

public class Coordinates extends Point implements Serializable {
  public static void main(String[] args) {
    try {
      Point p = new Point(5, 2);
      FileOutputStream fout = new FileOutputStream("point.ser");
      ObjectOutputStream oout = new ObjectOutputStream(fout);
      oout.writeObject(p);
      oout.close();
    } catch (Throwable t) { 
      // Forward to handler 
    }
 }
}

Compliant Solution

In the absence of sensitive data, classes can be serialized by simply implementing the java.io.Serializable interface. By doing so, the class indicates that no security issues may result from the object's serialization. Note that any derived sub classes also inherit this interface and are consequently serializable. This simple approach is inappropriate for any class that contains sensitive data.

When serializing a class that contains sensitive data, programs must ensure that sensitive data is omitted from the serialized form. This includes both suppressing serialization of data members that contain sensitive data, and also suppressing serialization of references to non-serializable or sensitive objects.
This compliant solution both avoids the possibility of incorrect serialization and also protects sensitive data members from accidental serialization by declaring the relevant members as transient so that they are omitted from the list of fields to be serialized by the default serialization mechanism.

public class Point {
 private transient double x; // declared transient
 private transient double y; // declared transient

 public Point(double x, double y) {
  this.x = x;
  this.y = y;
 }

 public Point()
 {
  //no argument constructor
 }

}

public class Coordinates extends Point implements Serializable {
  public static void main(String[] args) {
    try {
      Point p = new Point(5,2);
      FileOutputStream fout = new FileOutputStream("point.ser");
      ObjectOutputStream oout = new ObjectOutputStream(fout);
      oout.writeObject(p);
      oout.close();
    } catch (Exception e) {
      // Forward to handler
    }
  }
}

Other acceptable solutions include using custom implementations of the writeObject(), writeReplace() and writeExternal() methods that prevent sensitive fields from being written to the serialized stream, or use of custom implementations of the readObject(), readExternal() and readResolve() methods that conduct proper validation checks during deserialization; these techniques are often combined. Another acceptable approach is to define the serialPersistentFields array field and ensure that sensitive fields are omitted from the array. (See guideline SER00-J. Maintain serialization compatibility during class evolution.)

Noncompliant Code Example

Serialization can also be used maliciously. One example is returning multiple instances of a singleton-like class. In this noncompliant code example (based on [[Bloch 2005]]), a subclass SensitiveClass inadvertently becomes serializable because it extends the Exception class which implements Serializable.

public class SensitiveClass extends Exception {
  public static final SensitiveClass INSTANCE = new SensitiveClass();
  private SensitiveClass() {
    // Perform security checks and parameter validation
  }

  protected int printBalance() {
    int balance = 1000;
    return balance;
  }
}

class Malicious {
  public static void main(String[] args) {
    SensitiveClass sc = (SensitiveClass) deepCopy(SensitiveClass.INSTANCE);
    System.out.println(sc == SensitiveClass.INSTANCE);  // Prints false; indicates new instance
    System.out.println("Balance = " + sc.printBalance());
  }

  // This method should not be used in production quality code
  static public Object deepCopy(Object obj) {
    try {
      ByteArrayOutputStream bos = new ByteArrayOutputStream();
       new ObjectOutputStream(bos).writeObject(obj);
      ByteArrayInputStream bin = new ByteArrayInputStream(bos.toByteArray());
      return new ObjectInputStream(bin).readObject();
    } catch (Exception e) { 
      throw new IllegalArgumentException(e);
    }
  }
}

Compliant Solution

Extending a class or interface that implements Serializable should be avoided whenever possible. When extension of such a class is necessary, undue serialization of the subclass can be prohibited by throwing a NotSerializableException from a custom writeObject() or readResolve() method, defined in the subclass SensitiveClass. Note that the custom writeObject() or readResolve() methods must be declared final to prevent a malicious subclass from overriding them.

class SensitiveClass extends Exception {
  // ...
  private final Object readResolve() throws NotSerializableException {
    throw new NotSerializableException();
  }
}

Risk Assessment

If sensitive data can be serialized, it may be transmitted over an insecure link, or stored in an insecure medium, or disclosed inappropriately.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

[[Bloch 2005]] Puzzle 83: Dyslexic Monotheism
[[Bloch 2001]] Item 1: Enforce the singleton property with a private constructor
[[Greanier 2000]] Discover the secrets of the Java Serialization API
[[Harold 1999]]
[[JLS 2005]] Transient modifier
[[Long 2005]] Section 2.4, Serialization
[[MITRE 2009]] CWE ID 502 "Deserialization of Untrusted Data", CWE ID 499 "Serializable Class Containing Sensitive Data"
[[SCG 2007]] Guideline 5-1 Guard sensitive data during serialization
[[Sun 2006]] "Serialization specification: A.4 Preventing Serialization of Sensitive Data"

SER02-J. Extendable classes should not declare readResolve() and writeReplace() private or static      16. Serialization (SER)      SER04-J. Validate deserialized objects