Serial Killer Silently Pwning Your Java Endpoints

Finding Direct Deserializa;on Endpoints
Find calls (within your code and your dependencies’ code) to:
ObjectInputStream.readObject()
ObjectInputStream.readUnshared()
Where InputStream is aEacker controlled. For example:
1 InputStream is = request.getInputStream();
2 ObjectInputStream ois = new ObjectInputStream(is);
3 ois.readObject();
… and ObjectInputStream is or extends java.io.ObjectInputStream
… but is not a safe one (eg: Commons-io Valida@ngObjectInputStream)
33