ISC2 CISSP Practice Question

The correct answer is Processing data from untrusted sources without proper validation. Insecure deserialization is a vulnerability that occurs when an application deserializes untrusted data without sufficient validation, potentially allowing attackers to manipulate serialized objects to achieve harmful results like code execution. When applications deserialize data from untrusted sources without proper validation, attackers can craft malicious serialized objects that, when deserialized, can execute arbitrary code, modify application logic, or cause denial of service.

Failing to encrypt data is incorrect because failing to encrypt data refers to insufficient data protection at rest, which is a different type of vulnerability related to confidentiality rather than insecure deserialization, which is primarily about code execution and integrity.

Using weak hashing algorithms for passwords is incorrect because using weak hashing algorithms relates to insufficient credential protection, which is a different vulnerability category focused on authentication security rather than deserialization risks.

Sharing serialized objects between applications is incorrect because sharing serialized objects between applications is not inherently a vulnerability. The security issue arises from how the deserialization is performed, not from the fact that objects are shared between applications.