Software or Data Integrity Failures

The app trusts code or data without checking that it has not been tampered with.

## 1 · why it happens

If you load objects from user-controlled data, the attacker decides what gets created. Unsafe deserializers can be tricked into running code during that process.

The same idea applies to updates and pipelines: auto-updating from an unverified source, or a CI job that runs whatever a pull request contains, trusts something it never verified.

# JavaScript

✗ vulnerable

const serialize = require('node-serialize');
const prefs = serialize.unserialize(req.cookies.prefs);  // can execute code

✓ fixed

const prefs = JSON.parse(req.cookies.prefs);  // data only, no functions
const parsed = PrefsSchema.parse(prefs);         // validate the shape (e.g. zod)

# C#

✗ vulnerable

var settings = new JsonSerializerSettings
{
    TypeNameHandling = TypeNameHandling.All  // attacker picks the type
};
var obj = JsonConvert.DeserializeObject(body, settings);

✓ fixed

// Deserialize into a known type only
var dto = JsonSerializer.Deserialize<OrderDto>(body);
// Never use BinaryFormatter (removed in .NET 9)

## 2 · how attackers find it from outside

public source	what it tells them
Cookies & hidden fields	Base64 blobs that decode to serialized objects (e.g. starting with "rO0" for Java or "AAEAAAD" for .NET).
Public CI configs	Workflows that run untrusted pull-request code with secrets available.

→ all OSINT sources · run them on yourself

## 3 · how it's abused

⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.

{"rce":"_$$ND_FUNC$$_function(){ /* code */ }()"}

node-serialize treats this marker as a function and runs it while deserializing.

ysoserial.exe -f Json.Net -g ObjectDataProvider -o raw -c "calc"

Generates a .NET gadget chain for Json.NET with TypeNameHandling enabled.

Payload examples adapted from PayloadsAllTheThings (MIT, © Swissky). Full lists:Insecure Deserialization · Prototype Pollution

## 4 · fix

Deserialize only into known, simple types (DTOs). Validate after parsing.
Never deserialize untrusted data with type information enabled.
Sign and verify updates, artifacts and container images.
Do not expose secrets to CI jobs triggered by untrusted pull requests.

## 5 · detect

fix at source

Bearer

Static analysis that follows sensitive data through your code.

fix at source

Trivy

Vulnerabilities and misconfigurations in images, dependencies and IaC.

Official description: OWASP A08:2025 Software or Data Integrity Failures