Fix insecure deserialization in Java and Spring Boot

1. Find every new ObjectInputStream(...).readObject()/readUnshared(), every Spring RMI/HTTP-invoker or JMS ObjectMessage path, and any library (XStream, Kryo, SnakeYAML, Jackson with default typing) that rebuilds types from the data.
2. Prefer not to deserialize objects at all: accept JSON and bind it to a concrete DTO with Jackson (no activateDefaultTyping, no @class), or another schema format.
3. If you must read a serialized object, set an ObjectInputFilter allowlist with ObjectInputStream.setObjectInputFilter (or a JVM-wide jdk.serialFilter): list the exact classes and java.base/*, end with !*, and add maxdepth/maxrefs/maxbytes limits.
4. Never configure the filter as a blocklist of known gadget packages; a class you did not list is UNDECIDED and therefore allowed.
5. Add regression tests that deserialize a gadget-shaped class (its readObject writes a marker) and require the marker never appears, next to functional tests that round-trip the seed profile and preferences.
6. Do not return the deserialization exception to the client, and give the service account only the privileges it needs.

The three implementations share one API and one test suite; only the code below changes. The tests load the one that IMPL names.

@Override
public Profile restoreProfile(String token) {
    try {
        byte[] bytes = Base64.getDecoder().decode(token);
        try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
            // No filter: whatever class the stream names is resolved and
            // deserialized, and any readObject it defines runs.
            return (Profile) in.readObject();
        }
    } catch (Exception e) {
        throw new BadTokenException("invalid token", e);
    }
}

// Allow only Profile and the java.base platform classes it needs, and
// reject the rest (!*). java.base/* is a pragmatic baseline; a stricter
// allowlist names each class. A filter check happens before readObject.
private static final ObjectInputFilter PROFILE_FILTER =
        ObjectInputFilter.Config.createFilter("com.example.session.model.Profile;java.base/*;!*");

@Override
public Profile restoreProfile(String token) {
    try {
        byte[] bytes = Base64.getDecoder().decode(token);
        try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
            in.setObjectInputFilter(PROFILE_FILTER);
            return (Profile) in.readObject();
        }
    } catch (Exception e) {
        throw new BadTokenException("invalid token", e);
    }
}

// The preferences graph needs its collection classes too; allowlist the
// Preferences record plus java.base (HashMap, ArrayList, Boolean, the
// immutable-collection proxies), and reject everything else.
private static final ObjectInputFilter PREFERENCES_FILTER =
        ObjectInputFilter.Config.createFilter("com.example.session.model.Preferences;java.base/*;!*");

@Override
public Preferences loadPreferences(String token) {
    try {
        byte[] bytes = Base64.getDecoder().decode(token);
        try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
            in.setObjectInputFilter(PREFERENCES_FILTER);
            return (Preferences) in.readObject();
        }
    } catch (Exception e) {
        throw new BadTokenException("invalid preferences", e);
    }
}

// Reject the gadget packages from past advisories, allow everything else.
private static final ObjectInputFilter BLOCKLIST = ObjectInputFilter.Config.createFilter(
        "!org.apache.commons.collections.functors.*;"
        + "!org.apache.commons.collections4.functors.*;"
        + "!org.codehaus.groovy.runtime.*;"
        + "!com.sun.org.apache.xalan.internal.xsltc.trax.*;"
        + "!org.springframework.beans.factory.ObjectFactory");

@Override
public Profile restoreProfile(String token) {
    try {
        byte[] bytes = Base64.getDecoder().decode(token);
        try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
            in.setObjectInputFilter(BLOCKLIST);
            return (Profile) in.readObject();
        }
    } catch (Exception e) {
        throw new BadTokenException("invalid token", e);
    }
}

The exploit tests send the attack and check that it fails; functional tests next to them keep ordinary requests working, so a fix that rejects everything fails too.

// Exploit: the payload is a serialized MarkerGadget whose readObject writes
// a marker file. The fix must reject the class before readObject runs.

@Test
void exploitNativeGadgetInProfileDoesNotRun() throws Exception {
    Path marker = Files.createTempFile("fixcard-marker-", ".txt");
    Files.delete(marker);
    try {
        mvc.perform(get("/session/restore").param("token", token(new MarkerGadget(marker.toString()))));
        assertThat(Files.exists(marker))
                .as("insecure deserialization: the gadget's readObject ran").isFalse();
    } finally {
        Files.deleteIfExists(marker);
    }
}

@Test
void exploitNativeGadgetInPreferencesDoesNotRun() throws Exception {
    Path marker = Files.createTempFile("fixcard-marker-", ".txt");
    Files.delete(marker);
    try {
        mvc.perform(post("/session/preferences")
                .content(token(new MarkerGadget(marker.toString()))).contentType(MediaType.TEXT_PLAIN));
        assertThat(Files.exists(marker))
                .as("insecure deserialization: the gadget's readObject ran").isFalse();
    } finally {
        Files.deleteIfExists(marker);
    }
}

• An ObjectInputFilter is an allowlist only if it ends with !*. Without a terminal reject, unlisted classes are UNDECIDED and permitted, which is how the 'wrong' blocklist here is bypassed.
• The filter check runs when each class descriptor is read, before the object is created, so it stops a gadget before its readObject - but only for classes it actually rejects.
• java.base/* is a pragmatic baseline that allows every platform class; a strict allowlist names each class. Note java.base/** behaves differently from java.base/* and rejected the graph in testing - use java.base/*.
• Jackson is safe by default in this card because default typing is off; ObjectMapper.activateDefaultTyping (or the old enableDefaultTyping) re-introduces CWE-502. Spring Boot 4 ships Jackson 3, which restricts polymorphic typing by default - do not loosen it.
• Gadgets live in libraries on your classpath (commons-collections, groovy, xalan), not in your code, so 'we don't deserialize anything dangerous' is not a defence; the allowlist is.
• readResolve/readObject/validateObject run during deserialization; a serialized object graph can trigger them deep inside collections, which is why the allowlist must cover the whole graph (HashMap, ArrayList, the immutable-collection proxies).
• Signing the serialized blob and checking the signature before readObject stops a client swapping it, but only in addition to the allowlist, never instead.

1. Run the tests in all three modes: IMPL=fixed must pass; IMPL=vulnerable and IMPL=wrong must fail (node ../../run-all.mjs java-spring does this for you).
2. Run semgrep --config r/java.lang.security.audit.object-deserialization.object-deserialization src/main/java; expect it to flag every ObjectInputStream call, the fixed one included, then confirm by hand that fixed sets an allowlist filter.
3. Against your own endpoint, post a base64 serialized gadget and confirm no marker file is written and the request is rejected with 400.

What each rule reported when it was run on this card's code, or what its source shows it covers where it was not run. A rule that exists for the weakness does not always catch it.

Download the project, install its dependencies once (this step needs the network), then run the tests against each implementation from the deserialization/java-springfolder. Maven runs with JDK 21 (set JAVA_HOME).

mvn -B -q test

# Expected: every test passes
IMPL=fixed mvn -B -o -q test

# Expected: an exploit test fails
IMPL=vulnerable mvn -B -o -q test

# Expected: a test fails
IMPL=wrong mvn -B -o -q test

Each run writes a JUnit report to target/surefire-reports/TEST-*.xml. From the top folder of the download, node run-all.mjs deserialization/java-spring runs all three modes and checks the expected results.

Download the project ZIP, 22 KB

Verified

Toolchain

• openjdk 21.0.12.1
• maven 3.9.16
• springBoot 4.1.1
• junitJupiter 6.0.3
• jackson 3.1.7

Matrix

fixed: 7 of 7 tests pass; vulnerable: 2 of 7 tests fail (2 exploit tests); wrong: 2 of 7 tests fail (2 exploit tests)

Test results

IMPL=fixed 7/7 pass; IMPL=vulnerable 2 exploit tests fail (native gadget in the profile and in the preferences stream); IMPL=wrong 2 exploit tests fail (the gadget-package blocklist has no terminal !*, so MarkerGadget is UNDECIDED and allowed).

Scanners

Semgrep 1.180.0 from a throwaway venv (../.semgrep-venv), not a card dependency.

Versions and results hold for the toolchain above. The card's tests are the check: run them with your own versions before relying on the fix.

References

1. OWASP Deserialization Cheat Sheet
2. JEP 290: Filter Incoming Serialization Data
3. Java SE 21 API: ObjectInputFilter (pattern syntax)
4. Java SE 21 API: ObjectInputStream.setObjectInputFilter
5. Serialization Filtering (Java core libraries guide)
6. CWE-502: Deserialization of Untrusted Data
7. CAPEC-586: Object Injection
8. Find Security Bugs: OBJECT_DESERIALIZATION

Attack patterns:

• CAPEC-586 at MITRE