During the deserialization process, the state of an object will be reconstructed from the serialized data stream. By allowing unrestricted
deserialization of types, the application makes it possible for attackers to use types with dangerous or otherwise sensitive behavior during the
deserialization process.
When an application deserializes untrusted data without proper restrictions, an attacker can craft malicious serialized objects. Depending on the
affected objects and properties, the consequences can vary.
When the codebase contains objects that perform actions at deserialization time, they can be leveraged by attackers to perform the given actions in
order to modify the application business logic, leak sensitive information or compromise data integrity.
