Insecure Deserialization: How Tampering with Serialized Objects Leads to RCE
A Java web service accepts a Base64-encoded `profile` object from the browser. During testing, changing a serialized field from `role=user` to `role=admin` causes a deserialization error unless the original signed blob is reused. When a captured valid blob is modified only slightly, the application reconstructs a different class and then exposes an internal admin page. Which attack pattern is most likely?
Quick Answer
The answer is insecure deserialization, because the scenario demonstrates how tampering with serialized objects leads to RCE or privilege escalation when untrusted data is reconstructed into server-side objects. This attack pattern exploits the lack of integrity checks on serialized input—here, a Base64-encoded Java object—allowing an attacker to modify a field like `role=user` to `role=admin`, which causes the application to deserialize a different class and expose internal pages. On the Security+ SY0-701 exam, this tests your understanding of OWASP Top 10 risks and the principle of never deserializing data from untrusted sources without validation or signing. A common trap is confusing this with a buffer overflow or SQL injection, but the key clue is the reconstruction of a different class from modified serialized bytes. Memory tip: “If you can change a role by tweaking bytes, think deserialization—no integrity, no trust.”
⚠ Common exam trap
A common mix-up: candidates confuse the symptom (accessing an admin page) with a web-based attack like XSS or CSRF, but the root cause is the insecure deserialization of untrusted serialized data, not client-side script injection or request forgery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure deserialization, because untrusted serialized data is being reconstructed into server-side objects.
The scenario describes a classic insecure deserialization attack. The Java web service accepts a Base64-encoded serialized object from the browser and reconstructs it into server-side objects without integrity verification. When the attacker modifies a serialized field (role=user to role=admin), the application deserializes the tampered data, which causes a deserialization error unless the original signed blob is reused, but a slight modification reconstructs a different class and exposes an internal admin page. This directly matches the OWASP Top 10 insecure deserialization pattern where untrusted data is deserialized, leading to object injection and privilege escalation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Insecure deserialization, because untrusted serialized data is being reconstructed into server-side objects.
Why this is correct
Insecure deserialization is the best fit because the application accepts a serialized object from an untrusted source and turns it back into live server-side data. The fact that a small modification changes object behavior shows the server is trusting attacker-controlled serialized content. That can lead to authorization bypass, object confusion, or even code execution depending on the framework and validation controls.
- ✗
SQL injection, because the attacker is changing a field to access a different page.
Why it's wrong here
SQL injection involves manipulating a database query, usually through crafted input that changes SQL logic. This scenario never shows a database query or SQL syntax.
- ✗
Cross-site request forgery, because the browser is sending a forged request to the application.
Why it's wrong here
CSRF abuses an authenticated browser session to submit an unwanted request. Here, the core issue is reconstructing attacker-influenced serialized objects, not tricking a browser into making a state-changing request.
- ✗
Cross-site scripting, because the modified object exposes an internal admin page.
Why it's wrong here
XSS executes attacker-controlled script in the victim's browser. The problem here happens during server-side object reconstruction, before any browser script execution would matter.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Privilege escalation
Privilege escalation is when a user or attacker gains more access or control over a system than they are supposed to have.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A Java-based internal portal accepts a serialized object during profile import. After a recent test upload, the server made outbound LDAP calls and created a new local account. What attack pattern best explains this behavior?
medium- A.SQL injection, because the attacker likely altered a database query.
- B.Cross-site scripting, because the attacker could have injected script into the portal.
- ✓ C.Insecure deserialization, because a crafted object triggered unexpected server-side actions.
- D.CSRF, because the attacker may have forced an administrator to submit a form.
Why C: The scenario describes a Java application accepting a serialized object during profile import, which is a classic vector for insecure deserialization attacks. By crafting a malicious serialized object, an attacker can trigger arbitrary code execution on the server, leading to outbound LDAP calls and local account creation—actions that are not part of normal profile import logic. This attack exploits the trust placed in serialized data without proper validation or integrity checks.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.