mcp-server-semgrep/semgrep-rules/java/rmi/security/server-dangerous-class-deserialization.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: server-dangerous-class-deserialization
  severity: WARNING
  languages:
  - java
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    references:
    - https://mogwailabs.de/blog/2019/03/attacking-java-rmi-services-after-jep-290/
    category: security
    technology:
    - rmi
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
    confidence: LOW
  message: >-
    Using a non-primitive class with Java RMI may be an insecure deserialization vulnerability. Depending
    on the underlying implementation. This object could be manipulated by a malicious actor allowing them
    to
    execute code on your system. Instead, use an integer ID to look up your object, or consider alternative
    serialization schemes such as JSON.
  patterns:
  - pattern: |
      interface $INTERFACE extends Remote {
        $RETURNTYPE $METHOD($CLASS $PARAM) throws RemoteException;
      }
  - metavariable-regex:
      metavariable: $CLASS
      regex: (?!int|boolean|short|long|byte|char|float|double)