Serialization is the process that involves transforming a collection of objects into a file, typically
structured in XML or JSON format.
Deserialization is the reverse process of rebuilding the collection of objects from the XML or JSON
data file. The whole process can be used to make heterogeneous systems communicate with protocol such
as Soap.
We see in the graphics an example of serialization process.
And in this graphic, the inverse process of deserialization without any tampering.
The vulnerability arises if an attacker is able to tamper the XML or JSON structure and
have it processed by the deserialization process. The tampering can consist of adding or removing entire
new elements, adding or removing attributes or changing attributes values.
Among the remedies to remedy this vulnerability, mention should be made of the use of a digital
signature and the transmission of data by means of secure protocol such as https.
It is also recommended to deserialize to rely on standard tested and validated components and
libraries, and to do a type check when calling the method that deserializes.
Other useful indications to counteract risk, include the use of a log and monitoring mechanisms,
for deserialization.
Thank you for your kind attention.
Take care.