Top 10-2017 A8-Insecure Deserialization - Revision history

T.Gigler: Editorial changes e.g. line feeds, fixed colors

2018-01-01T16:57:58Z

Editorial changes e.g. line feeds, fixed colors

T.Gigler: Prepare OWASP Top 10-2017 Release (Content)

2017-12-14T23:12:08Z

Prepare OWASP Top 10-2017 Release (Content)

T.Gigler: Updated Navigation (incl PrevLink and NextLink)

2017-12-12T00:34:25Z

Updated Navigation (incl PrevLink and NextLink)

T.Gigler: 1st dummy page

2017-12-11T23:23:13Z

1st dummy page

New page

{{Top_10_2013:TopTemplate
|usenext=2013NextLink
|next=A9-{{Top_10_2010:ByTheNumbers
|9
|year=2017
|language=en}}
|useprev=2013PrevLink
|prev=A7-{{Top_10_2010:ByTheNumbers
|7
|year=2017
|language=en}}
|year=2017
|language=en
}}

{{Top_10_2013:BottomAdvancedTemplate
|type={{Top_10_2010:StyleTemplate}}
|usenext=2013NextLink
|next=A9-{{Top_10_2010:ByTheNumbers
|9
|year=2017
|language=en}}
|useprev=2013PrevLink
|prev=A7-{{Top_10_2010:ByTheNumbers
|7
|year=2017
|language=en}}
|year=2017
|language=en
}}

@@ Line 24: / Line 24: @@
      <td colspan=2  {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Security Weakness: --->
-  This issue is included in the Top 10 based on an <u>[https://owasp.blogspot.com/2017/08/owasp-top-10-2017-project-update.html industry survey]</u> and not on quantifiable data. Some tools can discover deserialization flaws, but human assistance is frequently needed to validate the problem. It is expected that prevalence data for deserialization flaws will increase as tooling is developed to help identify and address it. </td>
+  This issue is included in the Top 10 based on an <u>[https://owasp.blogspot.com/2017/08/owasp-top-10-2017-project-update.html industry survey]</u> and not on quantifiable data.<br/>Some tools can discover deserialization flaws, but human assistance is frequently needed to validate the problem. It is expected that prevalence data for deserialization flaws will increase as tooling is developed to help identify and address it. </td>
      <td colspan=2  {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Impacts: --->
-  The impact of deserialization flaws cannot be overstated. These flaws can lead to remote code execution attacks, one of the most serious attacks possible. The business impact depends on the protection needs of the application and data. </td>
+  The impact of deserialization flaws cannot be overstated. These flaws can lead to remote code execution attacks, one of the most serious attacks possible.<br/>The business impact depends on the protection needs of the application and data. </td>
 {{Top_10_2010:SummaryTableEndTemplate|year=2017}}
@@ Line 57: / Line 57: @@
 <b>Scenario #2</b>: A PHP forum uses PHP object serialization to save a "super" cookie, containing the user's user ID, role, password hash, and other state:
-{{Top_10_2010:ExampleBeginTemplate|year=2017}}<b><span style="color:red;">
+{{Top_10_2010:ExampleBeginTemplate|year=2017}}<b>a:4:{i:0;i:132;i:1;s:7:"<span style="color:red;">Mallory</span>";i:2;s:4:"<span style="color:red;">user</span>";
-a:4:{i:0;i:132;i:1;s:7:"Mallory";i:2;s:4:"user";
+i:3;s:32:"b6a8b3bea87fe0e05022f8f3c88bc960";}</b>{{Top_10_2010:ExampleEndTemplate}}
 An attacker changes the serialized object to give themselves admin privileges:
-{{Top_10_2010:ExampleBeginTemplate|year=2017}}<b><span style="color:red;">
+{{Top_10_2010:ExampleBeginTemplate|year=2017}}<b>
-a:4:{i:0;i:1;i:1;s:5:"Alice";i:2;s:5:"admin";
+a:4:{i:0;i:1;i:1;s:5:"<span style="color:red;">Alice</span>";i:2;s:5:"<span style="color:red;">admin</span>";
-i:3;s:32:"b6a8b3bea87fe0e05022f8f3c88bc960";}
+i:3;s:32:"b6a8b3bea87fe0e05022f8f3c88bc960";}</b>{{Top_10_2010:ExampleEndTemplate}}
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|year=2017|language=en}}
@@ Line 71: / Line 68: @@
 * <u>[[Deserialization_Cheat_Sheet|OWASP Cheat Sheet: Deserialization]]</u>
 * <u>[[OWASP_Proactive_Controls#4:_Validate_All_Inputs|OWASP Proactive Controls: Validate All Inputs]]</u>
-* <u>[[:Category:OWASP_Application_Security_Verification_Standard_Project#tab=Home|OWASP Application Security Verification Standard: TBA]]</u>
+* <u>[[:Category:OWASP_Application_Security_Verification_Standard_Project#tab=Home|OWASP Application Security Verification Standard]]</u>
 * <u>[https://speakerdeck.com/pwntester/surviving-the-java-deserialization-apocalypse OWASP AppSecEU 2016: Surviving the Java Deserialization Apocalypse]</u>
 * <u>[https://speakerdeck.com/pwntester/friday-the-13th-json-attacks OWASP AppSecUSA 2017: Friday the 13th JSON Attacks]</u>

@@ Line 1: / Line 1: @@
 {{Top_10_2013:TopTemplate
-     |usenext=2013NextLink
+     |usenext=2017NextLink
      |next=A9-{{Top_10_2010:ByTheNumbers
                |9
                |year=2017
                |language=en}}
-     |useprev=2013PrevLink
+     |useprev=2017PrevLink
      |prev=A7-{{Top_10_2010:ByTheNumbers
                |7
@@ Line 17: / Line 17: @@
 {{Top_10_2013:BottomAdvancedTemplate
      |type={{Top_10_2010:StyleTemplate}}
-     |usenext=2013NextLink
+     |usenext=2017NextLink
      |next=A9-{{Top_10_2010:ByTheNumbers
                |9
                |year=2017
                |language=en}}
-     |useprev=2013PrevLink
+     |useprev=2017PrevLink
      |prev=A7-{{Top_10_2010:ByTheNumbers
                |7