SLS-4: Insecure Deserialization

What is Serialization?

Serialization converts an object into a flat format (bytes, string) so it can be stored or sent over a network. Deserialization is the reverse — it rebuilds the object from that flat format.

Think of it like packing a suitcase. Serialization packs your belongings into a suitcase. Deserialization unpacks them. If someone hides a bomb in the suitcase and you open it without checking — it explodes.

flowchart LR
    A[Python Object] -->|serialize| B[Bytes / String]
    B -->|deserialize| C[Python Object]
    B -->|attacker injects code| D[Malicious Object]
    D -->|deserialize| E[Code Executes]

JSON is safe — it only carries data. Pickle is dangerous — it can execute arbitrary code during deserialization. Passing user input to pickle.loads() is the same as passing it to eval().

How to Spot It

Look for these in code:

Any endpoint that accepts serialized data from users is a target.