CWE-502 (可信数据的反序列化) — Vulnerability Class 1974

CWE-502 represents a critical security weakness where applications deserialize untrusted data without validating its integrity or structure. Attackers typically exploit this vulnerability by crafting malicious serialized objects that, when processed by the application, trigger unintended code execution or logic flaws. This often leads to remote code execution, denial of service, or privilege escalation, as the deserialization process may instantiate dangerous classes or invoke unsafe methods. To mitigate this risk, developers must strictly avoid deserializing data from untrusted sources. Instead, they should implement robust input validation, use allowlists for permitted data types, or adopt safer serialization formats like JSON that do not inherently support arbitrary object instantiation. Additionally, employing cryptographic signatures to verify data authenticity before deserialization ensures that only trusted, unaltered payloads are processed, effectively neutralizing the threat of malicious object injection.