...
Whether a violation of this rule is exploitable depends on what classes are on the JVM's classpath. (Note that this is a property of the execution environment, not of the code being audited.) In the worst case, it could lead to remote execution of arbitrary code.
Rule | Severity | Likelihood | Detectable | RepairableRemediation Cost | Priority | Level |
|---|---|---|---|---|---|---|
| SER12-J | High | Likely | No | No High | P9 | L2 |
Automated Detection
Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| CodeSonar |
| JAVA.CLASS.SER.ND | Serialization not disabled (Java) | ||||||
| Parasoft Jtest |
| CERT.SER12.VOBD | Validate objects before deserialization | ||||||
| PVS-Studio |
| V5333 | |||||||
| Useful for developing exploits that detect violation of this rule |
...