# Java Deserialization Security

> Comprehensive Guide to Java Deserialization Vulnerabilities
> Related Modules: `java_gadget_chains.md` (107+ Gadget Chains) | `java_fastjson.md` (Fastjson Specific)

---

## Deserialization Entry Points

### Native Java Serialization

```bash
# Detect ObjectInputStream usage
grep -rn "ObjectInputStream\|readObject\|readUnshared" --include="*.java"
grep -rn "\.readObject()" --include="*.java"
```

```java
// Dangerous pattern
ObjectInputStream ois = new ObjectInputStream(inputStream);
Object obj = ois.readObject();  // Deserializes arbitrary object
```

### JSON Deserialization

| Library | Dangerous Configuration | Safe Configuration |
|---------|----------------------|-------------------|
| **Fastjson** | `@type` + AutoType | safeMode=true |
| **Jackson** | enableDefaultTyping | Disable polymorphism |
| **Gson** | Safe by default | - |

> See also: `java_fastjson.md`

### XML Deserialization

| Library | Risk |
|---------|------|
| XStream | Deserializes arbitrary classes by default |
| XMLDecoder | Completely insecure |
| JAXB | Relatively safe |

```bash
# Detect XML deserialization
grep -rn "XStream\|XMLDecoder\|fromXML" --include="*.java"
```

---

## Dangerous Library Detection

```bash
# Check high-risk dependency versions
grep -rn "commons-collections.*3\\.[0-2]" pom.xml
grep -rn "commons-beanutils.*1\\.[0-8]" pom.xml
grep -rn "fastjson.*1\\.2\\.[0-6]" pom.xml
grep -rn "xstream.*1\\.[0-3]" pom.xml
```

---

## Common Gadget Chains

| Chain Name | Dependency | Trigger Condition |
|-----------|-----------|------------------|
| CommonsCollections1-7 | commons-collections 3.x | readObject |
| CommonsBeanutils | commons-beanutils | readObject |
| Spring1/2 | spring-core | readObject |
| JDK7u21 | JDK 7u21- | readObject |
| Fastjson | fastjson | JSON.parse |
| C3P0 | c3p0 | Various entry points |

> Full 107+ Gadget Chains: `java_gadget_chains.md`

---

## Detection Strategy

### 1. Entry Point Search

```bash
# All deserialization entry points
grep -rn "readObject\|fromXML\|JSON\.parse\|XMLDecoder" --include="*.java"

# Network entry points
grep -rn "ObjectInputStream.*getInputStream\|Socket.*readObject" --include="*.java"

# File entry points
grep -rn "FileInputStream.*ObjectInputStream\|deserialize.*File" --include="*.java"
```

### 2. Dependency Version Analysis

```bash
# Maven
mvn dependency:tree | grep -i "commons-collections\|beanutils\|fastjson"

# Gradle
gradle dependencies | grep -i "commons-collections\|beanutils\|fastjson"
```

### 3. Taint Tracking

```
Source: User input (HTTP parameters, file uploads, message queues)
    ↓
Propagation: Data passing
    ↓
Sink: readObject() / JSON.parse() / fromXML()
```

---

## Protection Measures

### 1. Input Validation

```java
// Use ObjectInputFilter (Java 9+)
ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
    "java.base/*;!*"  // Only allow java.base package
);
ois.setObjectInputFilter(filter);
```

### 2. Disable Dangerous Features

```java
// Fastjson: enable safe mode
ParserConfig.getGlobalInstance().setSafeMode(true);

// Jackson: disable polymorphic deserialization
objectMapper.disableDefaultTyping();

// XStream: set whitelist
xstream.allowTypes(new Class[] { SafeClass.class });
```

### 3. Upgrade Dependencies

```xml
<!-- Upgrade to safe version -->
<dependency>
    <groupId>commons-collections</groupId>
    <artifactId>commons-collections</artifactId>
    <version>3.2.2</version> <!-- Fixed version -->
</dependency>
```

---

## Audit Checklist

```
[ ] Search for all readObject / readUnshared calls
[ ] Check Fastjson/Jackson/XStream usage
[ ] Verify dependency versions for known vulnerabilities
[ ] Trace deserialization data sources
[ ] Check for input filtering/whitelisting
[ ] Verify data validation at network entry points
```

---

## Related Module Navigation

| Scenario | Recommended Module |
|----------|-------------------|
| Gadget Chain Details | `java_gadget_chains.md` |
| Fastjson Specific | `java_fastjson.md` |
| JNDI Injection | `java_jndi_injection.md` |
| Practical Cases | `java_practical.md` |
| Real-World Vulnerabilities | `cases/real_world_vulns.md` |
