Insecure Deserialization (ARCH4109)

Key java.security.insecure-deserialization · Severity critical · Category security · CWE CWE-502

Deserializing untrusted data with Java’s native ObjectInputStream is a classic vector for remote code execution via gadget chains. Use a strictly typed, safe data format such as JSON instead.

Incorrect

ObjectInputStream in = new ObjectInputStream(request.getInputStream());
Order order = (Order) in.readObject(); // gadget chain -> RCE

Correct

ObjectMapper mapper = JsonMapper.builder()
    .activateDefaultTyping(NoCheckSubTypeValidator.instance) // keep off
    .build();
Order order = mapper.readValue(request.getInputStream(), Order.class);

Fix

Use fixed-type JSON instead of native deserialization for untrusted data; never enable polymorphic typing.