4 ms·

I don't think I've ever worked on a project that deserialized untrusted Java objects; where does this come up? I suppose -- if you have a Java client for a (pr

by jtheory 11y ago

I don't think I've ever worked on a project that deserialized untrusted Java objects; where does this come up? I suppose -- if you have a Java client for a (probably) EJB-based server; most of the cases where I imagine this sort of setup are with internal-only solutions, though, which mitigates the risk somewhat (but obv. it would still need to be corrected). I've read about banks in some countries still commonly using Java applets for site access -- that could be a seriously-dangerous attack vector.

Nelson69 11y ago
I've been trying to figure that out too. Part of it is certainly some kind of bug hunter fame that is being played for. That just seems like bad architecture, period. Now if this can be exploited with RMI or something, I wouldn't be too shocked to see some client/server type applications using that as an interface. are there session cookies that are serialized objects or something?