Java Serialization Filtering - Prevent 0-day Security Vulnerabilities

Some of the most common security vulnerabilities are serialization vulnerabilities. As Brian Vermeer said: Java's serialization is the "gift that keeps giving".

This isn't our fault. Serialization is tricky to get right and even the JVM itself has some older code that made dubious serialization choices. But we can harden our code by blocking everything that we don't need. In those situations, even if a new serialization vulnerability is discovered it might not be exploitable on our JVM.

00:00 Introduction
00:24 The gift that keeps giving
00:54 Solutions
01:46 Serialization Filters
02:18 Whitelist vs. Blacklist
03:05 Command Line
04:39 Filter in Code
05:18 Final Word

[AndrewBerezovskiy]

Worth noting that this only deals with Java object serialization (ie implements Serializable) and will not help you against zero days in Jackson etc.