skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

java-serialization-audit

Audit Java source code for deserialization, XXE, and template injection vulnerabilities.

1.7k|238|Updated Dec 7, 2019
Search Tags:#security review#deserialization#xxe#gadget chain#SSTI#JAVA#Code Audit
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill java-serialization-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: java-serialization-audit
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/code-audit/java/java-serialization-audit
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill java-serialization-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Java white-box auditors need a systematic way to determine whether deserialization, XXE, and SSTI vulnerabilities actually exist in source code, including entry-point identification, data-flow tracing, gadget chain availability, and parser security configuration checks.

Core Features & Use Cases

  • Java Deserialization Audit: Identify ObjectInputStream/XMLDecoder entry points, trace data sources (HTTP, RMI, JMS, cache, cookies), and evaluate classpath gadget chain availability against commons-collections, commons-beanutils, spring-core, Groovy, and other libraries.
  • XXE Configuration Review: Verify secure feature settings across five XML parsers (DocumentBuilderFactory, SAXParser, XMLInputFactory, TransformerFactory, SchemaFactory) and analyze input sources and echo behavior.
  • SSTI Detection: Check Velocity, FreeMarker, and Thymeleaf rendering contexts for user-controlled template input and validate sandbox configurations like SecureUberspector and TemplateClassResolver.
  • Use Case: During a Java application code review, use this Skill to locate every readObject() call, confirm the session cookie is user-controlled, find commons-collections 3.2.1 in the dependency tree, and produce EVID-formatted evidence rated Critical.

Quick Start

Audit this Java project for deserialization, XXE, and SSTI vulnerabilities and report findings with evidence.

Frequently Asked Questions about java-serialization-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Java code for deserialization vulnerabilities?▼

Locate all ObjectInputStream.readObject() and XMLDecoder.readObject() calls, trace whether the serialized data comes from user-controlled sources like HTTP bodies or cookies, then check the dependency tree for known gadget chain libraries such as commons-collections or commons-beanutils.

How to check if Java XML parsers are vulnerable to XXE?▼

Review each parser factory for secure feature settings: DocumentBuilderFactory and SAXParserFactory need disallow-doctype-decl enabled, XMLInputFactory needs SUPPORT_DTD disabled, and TransformerFactory/SchemaFactory need ACCESS_EXTERNAL_DTD set to an empty string.

What makes Thymeleaf vulnerable to SSTI in Spring controllers?▼

Thymeleaf SSTI occurs when user input is concatenated into the controller's returned view name, allowing __${...}__ preprocessing expressions to trigger SpEL execution. The core defense is a view name whitelist, since Thymeleaf 3.x cannot disable preprocessing.

Does a Java deserialization flaw require a gadget chain to be exploitable?▼

Generally yes; exploitation requires a usable gadget chain in the classpath, such as commons-collections 3.x or commons-beanutils. However, custom readObject or readResolve implementations containing file operations or dynamic class loading also constitute attack surface without standard gadgets.

Why is a blacklist insufficient for Java deserialization defense?▼

Blacklists always lag behind newly discovered gadget chains and can be bypassed via array type obfuscation or secondary deserialization through SignedObject. Whitelist-based ObjectInputFilter or resolveClass overrides with default-deny semantics are the recommended approach.

Related Skills

Explore More Software Engineering Skills→
mdproctormdproctor
1

java-project-health

Run universal and Java-specific health checks on Maven and Gradle projects.

Community
Advanced
rabbicserabbicse

security-reviewer

Identify security vulnerabilities in code, dependencies, secrets, and infrastructure.

Community
Advanced
sseshachalasseshachala

hunt-xxe

Identify XXE vulnerabilities in XML parsers via inline and DTD payloads.

Community
Advanced
Q16GQ16G
83

graybox-p0

Orchestrate gray-box testing by combining white-box candidate discovery with black-box request validation.

Community
Intermediate