A transit application accepts serialized objects from untrusted clients and reconstructs them server-side. What class of risk should the tester emphasize without providing exploit recipes?
Select an answer to reveal the explanation.
Short Explanation
Opening mystery packages from strangers is a bad ops habit. Reconstructing untrusted serialized objects can lead to severe code-execution-class outcomes — call the class, recommend safe patterns, and skip the gadget cookbook. A JSON Content-Type sticker does not magically make unsafe loaders safe.
Full Explanation
Insecure deserialization occurs when applications reconstruct objects from attacker-controlled data using unsafe loaders, which can yield integrity failures or remote code execution-class impact depending on the platform. Testers should identify the pattern and recommend allowlisted types, signed payloads, or safer data formats — without shipping exploit PoCs. The issue is not limited to offline jobs and is independent of mTLS claims. Content-Type alone does not validate object safety.