Welcome back to the third and last part of his security serialization session.
In this part. We will discuss
insecurity serialization mitigation. We
will start discussing what makes an application vulnerable. And
then, we will hunt a wasp Juice Shop, vulnerable source
code. Before closing, this session. We
will discuss how to avoid such vulnerable at ease.
Whenever an application deserialize has data supplied by
external entities such as users or third-party systems,
then it is at risk. Note
that users? Applied data, includes HTTP, request
others, cookies, query string, parameters, request
body, data, metadata extracted, from
uploaded content, Etc. The
same way data gathered from external systems pose
a security risk malicious actors. May
go after search systems instead of directly.
Targeting your application. Let's
have a look at the source code.
From Juice Shop project page, we will jump to
the GitHub repo.
We are looking for the server.js file, where
we should find the Swagger setup as well as the B2B orders
API routes.
This is the Swagger you. Why set up?
And this is the B to be a Pi root. Handled by
the B2B order function implemented. The in the B2B order
dot J's file in the root folder. Let's
jump straight to the implementation.
We can see here that order lines data
is retrieved from the request body.
Then it is passed to the safe. Eval function, which
runs inside the sandbox.
Due to the timeout option. The denial of service was
not possible using the infinite Loop.
Let's discuss how to avoid insecurity serialization.
Always avoid accepting serialized objects from
untrusted sources. If you cannot avoid it
limit, serialization and deserialization to primitive
data types, only.
Implement Integrity checks such as digital signatures on
any serialized objects to prevent hostile data
object creation or data tampering. Performing
deserialization on a Sandbox or
low privileged environment helps lowering the impact of
insecurity. Serialization flows restrict
Network in such environments.
Log, deserialization exceptions in failures, especially
those related to an expected data types.
Monitor deserialization alerting, whenever suspicious activity,
is detected such as when a user deserialize frequently.
In our next session.
We will discuss using components with known vulnerabilities,
until then take your time to carefully,
read the insecure deserialization section of owasp
top 10.