Issue Summary

fix

This is reproducible on Data Center: Yes

Steps to Reproduce

1. Cannot be reproduced

Expected Results

Where possible, restrict the set of classes that can be deserialized. OWASP’s recommendation for readObject calls is to subclass the ObjectInputStream class, and override resolveClass to throw an exception if an unexpected type is deserialized. This would require understanding which classes need to be deserialized in each case.

Actual Results

Where possible, restrict the set of classes that can be deserialized. OWASP’s recommendation for readObject calls is to subclass the ObjectInputStream class, and override resolveClass to throw an exception if an unexpected type is deserialized. This would require understanding which classes need to be deserialized in each case.

The below exception is thrown in the xxxxxxx.log file:

...

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available