Java deserialization

Deserialization is the process of rebuilding a data stream into a Java object. The Open Web Application Security Project (OWASP) has identified insecure deserialization as one of the top ten security vulnerabilities for web applications. Pega Platform protects against this vulnerability by using features in the Java JDK.

Pega Platform white-lists known internal classes. At the system level, a global filter checks a blacklist of classes that are not allowed to be deserialized. If the filter flags a data stream as invalid, a security event is written to the security event log and the stream is not deserialized.