Question

A Java web application accepts serialized objects from client requests to restore user session state. During a security assessment, a tester crafts a malicious serialized payload that, when processed by the server, executes arbitrary system commands. The development team must remediate this vulnerability. Which approach BEST addresses the root cause?

Accepted Answer

Avoid deserializing untrusted data; use a simple data format like JSON with strict schema validation and integrity checks

Answer

Encrypt the serialized objects in transit using TLS so attackers cannot read or modify them

Answer

Add a web application firewall rule to block requests containing the string 'java.io.Serializable'

Answer

Increase the session timeout so serialized objects expire before they can be replayed