Chapter 9: Insecure Deserialization

.NET has full support for serialization and deserialization of data. This language feature allows ASP.NET Core web applications to convert in-memory objects into a stream of bytes (serialize) and rebuild these byte streams back to an object (deserialize). Serialization makes the transfer, storage, and caching of data possible, as well as state persistence between systems.

In the process of deserialization, the data format can be either JavaScript Object Notation (JSON) or Extensible Markup Language (XML), and it can also be in binary format. However, as with any input type, the data source can be untrustworthy or tampered with before it gets deserialized back into a web application as an in-memory object. This vulnerability is commonly known as insecure deserialization. The use of obsolete and dangerous deserializers, missing data validation, and misconfigured libraries are some of the root causes that have been identified as to why insecure deserialization...