6

Serializing Java Beans to XML using XMLEncoder and XMLDecoder seems like a pretty neat approach: many classes from many sources can be serialized reliably, just using their public interface. Using this aproach to serialization is even suggested in many places of the API reference. But the XML syntax used for this seems quite powerful. Are there any security mechanisms which will prevent attacks originating from malicious documents? Or should the use of XMLDecoder on untrusted documents be avoided for security reasons?

2 Answers 2

10

The deserialization of XML-serialized beans can cause prety much any operation which the JVM can perform. To give you an ugly examle, consider the following document which will write a certain file without any questions being asked:

<?xml version="1.0" encoding="UTF-8" ?>
<java version="1.4.0" class="java.beans.XMLDecoder">
  <object class="java.io.PrintWriter">
    <string>/tmp/Hacked.txt</string>
    <void method="println">
      <string>You have been hacked!</string>
    </void>
    <void method="close"/>
  </object>
</java>

This is roughly the same as a method

PrintWriter deserialize() {
    PrintWriter obj = new PrintWriter("/tmp/Hacked.txt");
    obj.println("You have been hacked!");
    obj.close();
    return obj;
}

For this reason, I strongly advise against simply reading data from untrusted sources using XMLDecoder.

Either validate the document to a well-defined and harmless subset of the XML language, or use your own formats together with technologies such as . Or perform the deserialization in a tightly controlled environment, with security managers which will disallow any unexpected operation.

2
  • 1
    Indeed. Guideline 3-8 of the current Secure Coding Guidelines for the Java Programming Language "Long Term Persistence of JavaBeans Components supports execution of Java statements." oracle.com/technetwork/java/seccodeguide-139067.html#3-8 Jan 13, 2013 at 21:00
  • @MvG , is there way by which I can generate an xml dump from any random object from the example above ? I tried with XMLEncoder / XStream but I could not get the exact sytax like you xml equivalent to the the deserialize() implementation.
    – Dibsyhex
    Sep 16, 2020 at 7:02
4

NO it absolutely is not safe to use.

The example MvG provide (in the accepted answer) doesn't paint the full picture.

Take a look at the examples I wrote on the Using XMLDecoder to execute server-side Java Code on an Restlet application (i.e. Remote Command Execution) blog post where I show how to:

  • Start processes,
  • upload class files,
  • write to server-side HTML OutputStream,
  • create XSS and
  • trigger a remote shell

all from XML files/strings that are parsed by XMLDecoder (and in the example shown in the blog post, via the Restlet's REST API ObjectRepresentation class)

1
  • 2
    To me, my answer demonstrated arbitrary code execution, and all the other aspects you describe are just symptoms of this. But I guess not everyone might make that connection, to server processes in particular, so it is good to state this explicitly. And having found a vulnerable framework makes this a lot more tangible. Have you contacted Restlet devs about this?
    – MvG
    Aug 6, 2013 at 15:52

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.