Description

Detects unsafe object deserialization vulnerabilities when using the node-serialize module in Express applications. When untrusted data is deserialized without proper validation, attackers can inject malicious serialized objects that execute arbitrary code during deserialization.

Detection Strategy

• The application imports both 'express' and 'node-serialize' modules

• Code contains deserialization function calls from the node-serialize module

• The deserialization operation processes untrusted/external data without proper validation

Vulnerable code example

import express from 'express';
import serialize from 'node-serialize';

const app = express();
app.use(express.json());

app.post('/api', (req, res) => {
    const obj = serialize.unserialize(userInput);  // Vulnerable: unsafe deserialization of user input...

✅ Secure code example

import express from 'express';

const app = express();
app.use(express.json());

app.post('/api', (req, res) => {
    try {
        // Use JSON.parse instead of serialize.unserialize to safely parse data...