Flag Java deserialization and unsafe Jackson typing

Jun 19, 2026 · 1 min read

Native Java deserialization of attacker bytes is critical when a gadget library is present. Grep for the readers and the risky Jackson configuration.

bash

grep -rEn "readObject|readUnshared|ObjectInputStream|XMLDecoder|readExternal" --include=*.java .
grep -rEn "enableDefaultTyping|activateDefaultTyping|@JsonTypeInfo(use *= *Id.CLASS" --include=*.java .

Confirm a usable gadget on the classpath.

bash

grep -RhoE "commons-collections|commons-beanutils|spring-core|groovy|rome" pom.xml build.gradle | sort -u

Pro note: polymorphic typing with class names in JSON is exploitable even behind an allow-list if the list is deny-based; check for the generics smuggling bypass. Recommend concrete types or a strict named-subtype registry rather than raw class ids in the payload.