> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-insecure-desiralization-labs/lab-5.md).

# lab-5

## Exploiting Java Deserialization with Apache Commons

**Difficulty:** Practitioner

### Lab Description

This lab uses a serialization-based session mechanism and loads the Apache Commons Collections library. Although there is no source code access, the lab can be exploited using pre-built gadget chains.

**Objective:** Use a third-party tool to generate a malicious serialized object containing a remote code execution payload, then pass it to the website to delete the `morale.txt` file from Carlos's home directory.

**Credentials:** `wiener:peter`

### Root Cause

The application deserializes untrusted Java objects from the session cookie without validating or restricting which classes can be instantiated. When the server receives the cookie, it passes the data directly into Java's deserialization mechanism (`ObjectInputStream.readObject()`). During deserialization, Java automatically reconstructs objects and invokes serialization callbacks such as `readObject()` and `readResolve()`.

The application also includes the Apache Commons Collections library on its classpath. This library contains classes that can be chained together into a **gadget chain** — although these classes were never intended for security-sensitive purposes, they can be abused so that deserialization eventually invokes attacker-controlled code.

Because the server:

* trusts client-controlled serialized data,
* performs unrestricted deserialization, and
* has exploitable gadget classes available on its classpath,

an attacker can achieve **remote code execution (RCE)** simply by supplying a malicious serialized object.

### Exploitation

1. Authenticate normally and observe that the session cookie contains a Base64-encoded serialized Java object. Decode it to confirm Java serialization is in use (Java serialized objects start with the magic bytes `AC ED`).
2. Use `ysoserial` to generate a malicious serialized object using the `CommonsCollections4` gadget chain with the target command:

   ```
   java -jar ysoserial.jar CommonsCollections4 'rm /home/carlos/morale.txt' | base64 -w 0
   ```
3. URL-encode the Base64 output and replace the session cookie with the malicious payload.
4. Send the request. The server deserializes the object, the Apache Commons Collections gadget chain fires automatically, and `Runtime.getRuntime().exec()` is called with the supplied command.
5. The OS command executes under the application's privileges, deleting `morale.txt` and completing the lab.

### Lesson Learned

* Never deserialize data received from users unless it is fully trusted and cryptographically verified.
* Java native serialization must not be used for data that can be modified by clients, such as cookies or request parameters.
* Treat serialized objects as executable content rather than passive data — deserialization can invoke code automatically.
* Keep third-party libraries updated, as many commonly used libraries (including older versions of Apache Commons Collections) contain known gadget chains that make deserialization attacks trivial.
* Apply class allowlists using `ObjectInputFilter` if deserialization is unavoidable.
* Prefer safer formats such as JSON or XML that do not instantiate arbitrary Java objects during parsing.
* Remove unnecessary libraries from production deployments to reduce the number of available gadget classes.
* Signing or encrypting serialized objects protects integrity but does not eliminate the inherent risks of Java deserialization if an attacker can still influence serialized data.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-insecure-desiralization-labs/lab-5.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.