90002—Java Serialization Object

PUBLISHEDsecurity alertMedium

Passive

Metadata

Alert ID:: 90002
Risk:: Medium
Type:: Passive
CWE:: CWE-502Deserialization of Untrusted Data

摘要

Java Serialization seems to be in use. If not correctly validated, an attacker can send a specially crafted object. This can lead to a dangerous “Remote Code Execution”. A magic sequence identifying JSO has been detected (Base64: rO0AB, Raw: 0xac, 0xed, 0x00, 0x05).

解决方案

Deserialization of untrusted data is inherently dangerous and should be avoided.

参考

browse all alerts