{"id":477613,"date":"2023-08-09T09:18:01","date_gmt":"2023-08-09T09:18:01","guid":{"rendered":""},"modified":"2023-09-05T11:15:06","modified_gmt":"2023-09-05T11:15:06","slug":"insecure-deserialization","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/cn\/wiki\/insecure-deserialization\/","title":{"rendered":"\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316"},"content":{"rendered":"<p>\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u662f Web \u5e94\u7528\u7a0b\u5e8f\u4e2d\u5b58\u5728\u7684\u4e00\u4e2a\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\u6765\u64cd\u7eb5\u6570\u636e\u5e76\u53ef\u80fd\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u5f53\u5e94\u7528\u7a0b\u5e8f\u76f2\u76ee\u5730\u5c06\u5e8f\u5217\u5316\u6570\u636e\u8f6c\u6362\u4e3a\u5bf9\u8c61\u800c\u6ca1\u6709\u8fdb\u884c\u9002\u5f53\u7684\u9a8c\u8bc1\u65f6\uff0c\u5c31\u4f1a\u51fa\u73b0\u6b64\u5b89\u5168\u6f0f\u6d1e\uff0c\u4ece\u800c\u5bfc\u81f4\u4e25\u91cd\u540e\u679c\uff0c\u4f8b\u5982\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95ee\u3001\u6570\u636e\u7be1\u6539\u548c\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002<\/p>\n<h2>\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u7684\u8d77\u6e90\u5386\u53f2\u4ee5\u53ca\u9996\u6b21\u63d0\u53ca\u5b83<\/h2>\n<p>\u5e8f\u5217\u5316\u7684\u6982\u5ff5\u53ef\u4ee5\u8ffd\u6eaf\u5230\u8ba1\u7b97\u673a\u53d1\u5c55\u7684\u65e9\u671f\uff0c\u5f53\u65f6\u5f00\u53d1\u4eba\u5458\u9700\u8981\u4e00\u79cd\u9ad8\u6548\u5b58\u50a8\u548c\u4f20\u8f93\u6570\u636e\u7684\u65b9\u6cd5\u3002\u7b2c\u4e00\u6b21\u63d0\u5230\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u662f\u4e00\u4e2a\u5b89\u5168\u95ee\u9898\u53ef\u4ee5\u8ffd\u6eaf\u5230 Philippe Delteil \u548c Stefano Di Paola \u5728 2006 \u5e74 OWASP AppSec \u4f1a\u8bae\u4e0a\u7684\u4e00\u6b21\u6f14\u8bb2\u3002\u4ed6\u4eec\u5f3a\u8c03\u4e86\u4e0e\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u76f8\u5173\u7684\u98ce\u9669\uff0c\u4e3a\u5b89\u5168\u793e\u533a\u7684\u8fdb\u4e00\u6b65\u7814\u7a76\u548c\u8ba4\u8bc6\u94fa\u5e73\u4e86\u9053\u8def\u3002<\/p>\n<h2>\u6709\u5173\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u7684\u8be6\u7ec6\u4fe1\u606f<\/h2>\n<p>\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u662f\u6307\u5e94\u7528\u7a0b\u5e8f\u83b7\u53d6\u5e8f\u5217\u5316\u6570\u636e\uff08\u901a\u5e38\u91c7\u7528 JSON\u3001XML \u6216 PHP \u7684\u539f\u751f\u5e8f\u5217\u5316\u683c\u5f0f\uff09\u5e76\u5c06\u5176\u8f6c\u6362\u56de\u5bf9\u8c61\u6216\u6570\u636e\u7ed3\u6784\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u6b64\u8fc7\u7a0b\uff0c\u901a\u8fc7\u5236\u4f5c\u6076\u610f\u64cd\u7eb5\u7684\u5e8f\u5217\u5316\u6570\u636e\u6765\u6b3a\u9a97\u5e94\u7528\u7a0b\u5e8f\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002<\/p>\n<p>\u5728\u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\u4e2d\uff0c\u5e94\u7528\u7a0b\u5e8f\u901a\u5e38\u901a\u8fc7\u8c03\u7528\u76f8\u5e94\u7684\u7c7b\u6784\u9020\u51fd\u6570\u6216\u5de5\u5382\u65b9\u6cd5\u4ece\u5e8f\u5217\u5316\u6570\u636e\u4e2d\u91cd\u5efa\u5bf9\u8c61\u3002\u4e3b\u8981\u95ee\u9898\u5728\u4e8e\u6b64\u8fc7\u7a0b\u4e2d\u7f3a\u4e4f\u9002\u5f53\u7684\u8f93\u5165\u9a8c\u8bc1\u548c\u5b89\u5168\u68c0\u67e5\u4e0d\u8db3\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u7be1\u6539\u5e8f\u5217\u5316\u6570\u636e\uff0c\u6ce8\u5165\u6709\u5bb3\u8d1f\u8f7d\u6216\u4fee\u6539\u5bf9\u8c61\u5c5e\u6027\uff0c\u4ece\u800c\u5bfc\u81f4\u610f\u5916\u884c\u4e3a\u751a\u81f3\u5b8c\u5168\u7834\u574f\u5e94\u7528\u7a0b\u5e8f\u3002<\/p>\n<h2>\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u7684\u5185\u90e8\u7ed3\u6784\u53ca\u5176\u5de5\u4f5c\u539f\u7406<\/h2>\n<p>\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u6e90\u4e8e\u5e8f\u5217\u5316\u6570\u636e\u7684\u5904\u7406\u65b9\u5f0f\u3002\u4ee5\u4e0b\u6b65\u9aa4\u8bf4\u660e\u4e86\u5176\u5de5\u4f5c\u539f\u7406\uff1a<\/p>\n<ol>\n<li>\n<p>\u5e8f\u5217\u5316\uff1a\u5e94\u7528\u7a0b\u5e8f\u5c06\u5bf9\u8c61\u6216\u6570\u636e\u7ed3\u6784\u8f6c\u6362\u4e3a\u5e8f\u5217\u5316\u683c\u5f0f\uff08\u4f8b\u5982JSON\u6216XML\uff09\uff0c\u4ee5\u65b9\u4fbf\u5b58\u50a8\u6216\u4f20\u8f93\u3002<\/p>\n<\/li>\n<li>\n<p>\u53cd\u5e8f\u5217\u5316\uff1a\u5e94\u7528\u7a0b\u5e8f\u83b7\u53d6\u5e8f\u5217\u5316\u7684\u6570\u636e\u5e76\u91cd\u5efa\u539f\u59cb\u5bf9\u8c61\u6216\u6570\u636e\u7ed3\u6784\u3002<\/p>\n<\/li>\n<li>\n<p>\u7f3a\u4e4f\u9a8c\u8bc1\uff1a\u5f53\u5e94\u7528\u7a0b\u5e8f\u65e0\u6cd5\u9a8c\u8bc1\u4f20\u5165\u7684\u5e8f\u5217\u5316\u6570\u636e\u65f6\uff0c\u5c31\u4f1a\u51fa\u73b0\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\uff0c\u5047\u8bbe\u5b83\u59cb\u7ec8\u6765\u81ea\u53d7\u4fe1\u4efb\u7684\u6765\u6e90\u3002<\/p>\n<\/li>\n<li>\n<p>\u6076\u610f\u8d1f\u8f7d\uff1a\u653b\u51fb\u8005\u7cbe\u5fc3\u5236\u4f5c\u64cd\u7eb5\u7684\u5e8f\u5217\u5316\u6570\u636e\uff0c\u5d4c\u5165\u6709\u5bb3\u4ee3\u7801\u6216\u4fee\u6539\u5e8f\u5217\u5316\u5bf9\u8c61\u7684\u5c5e\u6027\u3002<\/p>\n<\/li>\n<li>\n<p>\u4ee3\u7801\u6267\u884c\uff1a\u5f53\u88ab\u64cd\u7eb5\u7684\u5e8f\u5217\u5316\u6570\u636e\u88ab\u53cd\u5e8f\u5217\u5316\u65f6\uff0c\u5e94\u7528\u7a0b\u5e8f\u4f1a\u5728\u4e0d\u77e5\u60c5\u7684\u60c5\u51b5\u4e0b\u6267\u884c\u6076\u610f\u4ee3\u7801\uff0c\u4ece\u800c\u5bfc\u81f4\u6f5c\u5728\u7684\u6f0f\u6d1e\u3002<\/p>\n<\/li>\n<\/ol>\n<h2>\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u7684\u5173\u952e\u7279\u5f81\u5206\u6790<\/h2>\n<p>\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u7684\u4e3b\u8981\u7279\u5f81\u53ef\u4ee5\u6982\u62ec\u5982\u4e0b\uff1a<\/p>\n<ul>\n<li>\n<p><strong>\u6f0f\u6d1e\u5229\u7528\u96be\u5ea6<\/strong>\uff1a\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u76f8\u5bf9\u5bb9\u6613\u88ab\u5229\u7528\uff0c\u56e0\u6b64\u6210\u4e3a\u653b\u51fb\u8005\u7684\u70ed\u95e8\u76ee\u6807\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u9690\u5f62\u653b\u51fb<\/strong>\uff1a\u7531\u4e8e\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u4e0d\u9700\u8981\u4efb\u4f55\u6587\u4ef6\u4e0a\u4f20\u6216\u76f4\u63a5\u4ee3\u7801\u6ce8\u5165\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u79d8\u5bc6\u64cd\u4f5c\uff0c\u9003\u907f\u4f20\u7edf\u7684\u5b89\u5168\u63aa\u65bd\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u91cd\u5927\u540e\u679c<\/strong>\uff1a\u6210\u529f\u7684\u653b\u51fb\u53ef\u80fd\u5bfc\u81f4\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95ee\u3001\u6570\u636e\u7be1\u6539\u6216\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\uff0c\u4ece\u800c\u53ef\u80fd\u5bfc\u81f4\u6574\u4e2a\u7cfb\u7edf\u53d7\u5230\u635f\u5bb3\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u4e0d\u53ef\u9884\u6d4b\u7684\u6709\u6548\u8f7d\u8377<\/strong>\uff1a\u653b\u51fb\u8005\u53ef\u4ee5\u6784\u5efa\u81ea\u5b9a\u4e49\u8d1f\u8f7d\uff0c\u4ee5\u72ec\u7279\u4e14\u610f\u60f3\u4e0d\u5230\u7684\u65b9\u5f0f\u5229\u7528\u8be5\u5e94\u7528\u7a0b\u5e8f\u3002<\/p>\n<\/li>\n<\/ul>\n<h2>\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u7684\u7c7b\u578b<\/h2>\n<p>\u6839\u636e\u7279\u5b9a\u7684\u653b\u51fb\u5a92\u4ecb\u6216\u6240\u4f7f\u7528\u7684\u7f16\u7a0b\u8bed\u8a00\uff0c\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u53ef\u5206\u4e3a\u4e0d\u540c\u7c7b\u578b\u3002\u4ee5\u4e0b\u662f\u4e00\u4e9b\u5e38\u89c1\u7c7b\u578b\uff1a<\/p>\n<table>\n<thead>\n<tr>\n<th>\u7c7b\u578b<\/th>\n<th>\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c<\/td>\n<td>\u653b\u51fb\u8005\u5728\u670d\u52a1\u5668\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u83b7\u5f97\u5bf9\u7cfb\u7edf\u7684\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95ee\u548c\u63a7\u5236\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u5bf9\u8c61\u6ce8\u5165<\/td>\n<td>\u6076\u610f\u5bf9\u8c61\u88ab\u6ce8\u5165\u5230\u5e94\u7528\u7a0b\u5e8f\u4e2d\uff0c\u53ef\u80fd\u4f1a\u5bfc\u81f4\u6570\u636e\u64cd\u7eb5\u6216\u6cc4\u9732\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u62d2\u7edd\u670d\u52a1<\/td>\n<td>\u7cbe\u5fc3\u8bbe\u8ba1\u7684\u5e8f\u5217\u5316\u6570\u636e\u4f1a\u5bfc\u81f4\u5e94\u7528\u7a0b\u5e8f\u6d88\u8017\u8fc7\u591a\u7684\u8d44\u6e90\uff0c\u4ece\u800c\u5f15\u53d1 DoS \u653b\u51fb\u3002<\/td>\n<\/tr>\n<tr>\n<td>\u7c7b\u578b\u6df7\u6dc6<\/td>\n<td>\u653b\u51fb\u8005\u5229\u7528\u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\u4e2d\u57fa\u4e8e\u7c7b\u578b\u7684\u5904\u7406\u9519\u8bef\u6765\u7834\u574f\u7cfb\u7edf\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u7684\u4f7f\u7528\u65b9\u6cd5\u3001\u95ee\u9898\u53ca\u5176\u89e3\u51b3\u65b9\u6848<\/h2>\n<h3>\u4f7f\u7528\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u7684\u65b9\u6cd5\uff1a<\/h3>\n<ul>\n<li>\n<p><strong>\u6570\u636e\u7be1\u6539<\/strong>\uff1a\u653b\u51fb\u8005\u53ef\u4ee5\u4fee\u6539\u5e8f\u5217\u5316\u6570\u636e\u6765\u7be1\u6539\u5e94\u7528\u7a0b\u5e8f\u903b\u8f91\uff0c\u4fee\u6539\u654f\u611f\u4fe1\u606f\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u8eab\u4efd\u4f2a\u9020<\/strong>\uff1a\u53ef\u4ee5\u64cd\u7eb5\u5e8f\u5217\u5316\u6570\u636e\u6765\u4f2a\u9020\u7528\u6237\u8eab\u4efd\uff0c\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u673a\u5236\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u547d\u4ee4\u6267\u884c<\/strong>\uff1a\u6076\u610f\u4ee3\u7801\u53ef\u4ee5\u6ce8\u5165\u5e8f\u5217\u5316\u6570\u636e\uff0c\u5bfc\u81f4\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u3002<\/p>\n<\/li>\n<\/ul>\n<h3>\u95ee\u9898\u53ca\u5176\u89e3\u51b3\u65b9\u6848\uff1a<\/h3>\n<ul>\n<li>\n<p><strong>\u8f93\u5165\u9a8c\u8bc1<\/strong>\uff1a\u5b9e\u65bd\u4e25\u683c\u7684\u8f93\u5165\u9a8c\u8bc1\uff0c\u4ee5\u786e\u4fdd\u5728\u53cd\u5e8f\u5217\u5316\u8fc7\u7a0b\u4e2d\u53ea\u5904\u7406\u53d7\u4fe1\u4efb\u548c\u9884\u671f\u7684\u6570\u636e\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u4f7f\u7528\u53d7\u4fe1\u4efb\u7684\u5e93<\/strong>\uff1a\u91c7\u7528\u5b8c\u5584\u4e14\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u5e93\uff0c\u63d0\u4f9b\u9488\u5bf9\u5e38\u89c1\u653b\u51fb\u7684\u5185\u7f6e\u4fdd\u62a4\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u767d\u540d\u5355<\/strong>\uff1a\u5728\u53cd\u5e8f\u5217\u5316\u671f\u95f4\u521b\u5efa\u5141\u8bb8\u7684\u7c7b\u6216\u6570\u636e\u7c7b\u578b\u7684\u767d\u540d\u5355\uff0c\u4ee5\u9632\u6b62\u610f\u5916\u5bf9\u8c61\u7684\u5b9e\u4f8b\u5316\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u6c99\u76d2<\/strong>\uff1a\u5728\u6c99\u76d2\u73af\u5883\u4e2d\u6267\u884c\u53cd\u5e8f\u5217\u5316\uff0c\u4ee5\u9650\u5236\u5bf9\u5173\u952e\u8d44\u6e90\u7684\u8bbf\u95ee\u5e76\u9632\u6b62\u672a\u7ecf\u6388\u6743\u7684\u64cd\u4f5c\u3002<\/p>\n<\/li>\n<\/ul>\n<h2>\u4e3b\u8981\u7279\u70b9\u53ca\u4e0e\u540c\u7c7b\u672f\u8bed\u7684\u5176\u4ed6\u6bd4\u8f83<\/h2>\n<p>\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u4e0e\u5176\u4ed6 Web \u5e94\u7528\u7a0b\u5e8f\u6f0f\u6d1e\u6709\u76f8\u4f3c\u4e4b\u5904\uff0c\u4f46\u5b83\u5177\u6709\u4ee5\u4e0b\u72ec\u7279\u4e4b\u5904\uff1a<\/p>\n<ul>\n<li>\n<p><strong>\u7c7b\u4f3c\u4e8e \u4ee3\u7801\u6ce8\u5165<\/strong>\uff1a\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u4e0e\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\u6709\u67d0\u4e9b\u76f8\u4f3c\u4e4b\u5904\uff0c\u4f46\u5b83\u5728\u53cd\u5e8f\u5217\u5316\u7684\u80cc\u666f\u4e0b\u8fd0\u884c\uff0c\u56e0\u6b64\u6709\u6240\u4e0d\u540c\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u4e0e SQL \u6ce8\u5165\u7684\u533a\u522b<\/strong>\uff1a\u867d\u7136 SQL \u6ce8\u5165\u9488\u5bf9\u6570\u636e\u5e93\uff0c\u4f46\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u5219\u4fa7\u91cd\u4e8e\u64cd\u7eb5\u5e8f\u5217\u5316\u6570\u636e\u3002<\/p>\n<\/li>\n<li>\n<p><strong>\u5728 Web \u5e94\u7528\u7a0b\u5e8f\u4e2d\u5f88\u5e38\u89c1<\/strong>\uff1a\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u5728\u5904\u7406\u6765\u81ea\u7528\u6237\u8f93\u5165\u6216\u5916\u90e8 API \u7684\u5e8f\u5217\u5316\u6570\u636e\u7684 Web \u5e94\u7528\u7a0b\u5e8f\u4e2d\u66f4\u4e3a\u666e\u904d\u3002<\/p>\n<\/li>\n<\/ul>\n<h2>\u4e0e\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u76f8\u5173\u7684\u672a\u6765\u89c2\u70b9\u548c\u6280\u672f<\/h2>\n<p>\u968f\u7740 Web \u5e94\u7528\u7a0b\u5e8f\u5b89\u5168\u9886\u57df\u7684\u4e0d\u65ad\u53d1\u5c55\uff0c\u5b89\u5168\u5e8f\u5217\u5316\u548c\u53cd\u5e8f\u5217\u5316\u5e93\u6709\u671b\u53d6\u5f97\u8fdb\u6b65\u3002\u5f00\u53d1\u4eba\u5458\u5c06\u8d8a\u6765\u8d8a\u91cd\u89c6\u8f93\u5165\u9a8c\u8bc1\u548c\u66f4\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u6280\u672f\u3002\u6b64\u5916\uff0c\u81ea\u52a8\u5316\u5b89\u5168\u5de5\u5177\u5c06\u7ee7\u7eed\u6539\u8fdb\u5bf9\u4e0d\u5b89\u5168\u53cd\u5e8f\u5217\u5316\u6f0f\u6d1e\u7684\u68c0\u6d4b\u548c\u7f13\u89e3\u3002<\/p>\n<h2>\u4ee3\u7406\u670d\u52a1\u5668\u5982\u4f55\u4f7f\u7528\u6216\u4e0e\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u76f8\u5173\u8054<\/h2>\n<p>\u4ee3\u7406\u670d\u52a1\u5668\u901a\u8fc7\u62e6\u622a\u548c\u8fc7\u6ee4\u5ba2\u6237\u7aef\u4e0e\u670d\u52a1\u5668\u4e4b\u95f4\u7684\u6d41\u91cf\uff0c\u5728\u7f51\u7edc\u5b89\u5168\u4e2d\u53d1\u6325\u7740\u81f3\u5173\u91cd\u8981\u7684\u4f5c\u7528\u3002\u5b83\u4eec\u53ef\u7528\u4e8e\u68c0\u6d4b\u548c\u963b\u6b62\u5305\u542b\u64cd\u7eb5\u7684\u5e8f\u5217\u5316\u6570\u636e\u7684\u6076\u610f\u8bf7\u6c42\uff0c\u4ece\u800c\u4e3a\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u653b\u51fb\u63d0\u4f9b\u989d\u5916\u7684\u9632\u5fa1\u5c42\u3002<\/p>\n<h2>\u76f8\u5173\u94fe\u63a5<\/h2>\n<p>\u6709\u5173\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u548c Web \u5e94\u7528\u7a0b\u5e8f\u5b89\u5168\u7684\u66f4\u591a\u4fe1\u606f\uff0c\u8bf7\u8003\u8651\u63a2\u7d22\u4ee5\u4e0b\u8d44\u6e90\uff1a<\/p>\n<ul>\n<li><a href=\"https:\/\/owasp.org\/www-project-cheat-sheets\/cheatsheets\/Deserialization_Cheat_Sheet\" target=\"_new\" rel=\"noopener nofollow\">OWASP \u53cd\u5e8f\u5217\u5316\u5907\u5fd8\u5355<\/a><\/li>\n<li><a href=\"https:\/\/csrc.nist.gov\/publications\/detail\/sp\/800-53\/rev-5\/draft\" target=\"_new\" rel=\"noopener nofollow\">NIST \u5e94\u7528\u7a0b\u5e8f\u5b89\u5168\u6307\u5357<\/a><\/li>\n<li><a href=\"https:\/\/www.sans.org\/security-awareness-training\/sans-security-awareness-blog\/what-is-insecure-deserialization-and-how-to-avoid-it\" target=\"_new\" rel=\"noopener nofollow\">SANS \u5b89\u5168\u7f16\u7801<\/a><\/li>\n<\/ul>\n<p>\u603b\u4e4b\uff0c\u4e86\u89e3\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u5bf9\u4e8e\u5f00\u53d1\u4eba\u5458\u3001\u5b89\u5168\u4e13\u4e1a\u4eba\u5458\u548c\u4f01\u4e1a\u6765\u8bf4\u81f3\u5173\u91cd\u8981\uff0c\u4ee5\u786e\u4fdd Web \u5e94\u7528\u7a0b\u5e8f\u7684\u5b89\u5168\u6027\u548c\u5b8c\u6574\u6027\u3002\u901a\u8fc7\u5b9e\u65bd\u6700\u4f73\u5b9e\u8df5\u3001\u5229\u7528\u5b89\u5168\u5e93\u5e76\u4fdd\u6301\u5bf9\u65b0\u51fa\u73b0\u7684\u5a01\u80c1\u7684\u8b66\u60d5\uff0c\u6211\u4eec\u53ef\u4ee5\u52a0\u5f3a\u6211\u4eec\u7684\u7cfb\u7edf\u4ee5\u62b5\u5fa1\u6f5c\u5728\u7684\u653b\u51fb\uff0c\u5e76\u4fdd\u62a4\u654f\u611f\u6570\u636e\u514d\u906d\u672a\u7ecf\u6388\u6743\u7684\u8bbf\u95ee\u548c\u64cd\u7eb5\u3002<\/p>","protected":false},"featured_media":477614,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477613","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Insecure Deserialization: Understanding the Risks and Solutions<\/mark>","faq_items":[{"question":"What is Insecure Deserialization?","answer":"<p>Insecure deserialization is a vulnerability found in web applications where serialized data is converted back into objects without proper validation. Attackers can exploit this flaw to manipulate data and potentially execute malicious code, leading to unauthorized access or system compromise.<\/p>"},{"question":"How did Insecure Deserialization come into existence?","answer":"<p>The concept of serialization has been used in computing for a long time, but the first mention of insecure deserialization as a security concern dates back to a presentation in 2006. Philippe Delteil and Stefano Di Paola highlighted the risks associated with deserialization vulnerabilities at the OWASP AppSec conference, sparking further research and awareness.<\/p>"},{"question":"How does Insecure Deserialization work?","answer":"<p>During the deserialization process, an application reconstructs objects from serialized data. Insecure deserialization arises due to the lack of proper validation. Attackers craft manipulated serialized data with harmful payloads or modified properties. When this data is deserialized, the application unknowingly executes the malicious code, leading to potential exploits.<\/p>"},{"question":"What are the key features of Insecure Deserialization?","answer":"<p>Insecure deserialization is relatively easy for attackers to exploit, and it allows them to execute code covertly. The consequences of successful attacks can be severe, leading to unauthorized access, data tampering, or even full system compromise. Attackers can also construct unpredictable payloads for exploitation.<\/p>"},{"question":"What are the types of Insecure Deserialization?","answer":"<p>Insecure deserialization vulnerabilities can be categorized into different types, including remote code execution, object injection, denial of service, and type confusion. Each type poses unique risks and challenges for developers and security professionals.<\/p>"},{"question":"How can Insecure Deserialization be used, and what are the solutions?","answer":"<p>Attackers can use insecure deserialization to tamper with data, forge identities, or execute commands. To mitigate these risks, developers should implement strict input validation, use trusted libraries, whitelist allowed classes, and execute deserialization in a sandboxed environment.<\/p>"},{"question":"How does Insecure Deserialization compare to other web vulnerabilities?","answer":"<p>Insecure deserialization is similar to code injection but operates within the context of deserialization. It differs from SQL injection, which targets databases. This vulnerability is more common in web applications dealing with serialized data from user input or external APIs.<\/p>"},{"question":"What are the future perspectives related to Insecure Deserialization?","answer":"<p>As web application security evolves, advancements in secure serialization and deserialization libraries are expected. Developers will prioritize input validation and safer deserialization techniques, while automated security tools will improve detection and mitigation.<\/p>"},{"question":"How can proxy servers be associated with Insecure Deserialization?","answer":"<p>Proxy servers play a crucial role in web security by intercepting and filtering traffic. They can help detect and block malicious requests containing manipulated serialized data, providing an additional layer of defense against insecure deserialization attacks.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477613\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media\/477614"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media?parent=477613"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}