Serialized object in HTTP message
Summary: PortSwigger Research describes applications that submit a serialized object in a request parameter, which can expose the application to code execution vulnerabilities through its use of serialized objects. The text notes that exploiting such code execution typically requires attacker access to the server-side application's source code, though vulnerabilities in native deserialization functions often allow practical exploitation without source code access.
What you should know: The source's own mitigation advice is to stop passing serialized objects in request parameters at all, and where that is unavoidable, to add a server-generated cryptographic signature validated before deserialization - a control that only helps if it is actually in place.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026