AGENTFORCE-AF-22: Unsafe Deserialization in A2A Agent Server
🚨 Critical · Agent Network Security
Detects Java agent servers (A2A, MCP or agent-framework projects) that deserialize data with APIs that let the input choose which classes to build: ObjectInputStream.readObject without an ObjectInputFilter, XMLDecoder, Jackson default typing (enableDefaultTyping, activateDefaultTyping with an open validator), @JsonTypeInfo(use = Id.CLASS), XStream without type permissions, SnakeYAML without SafeConstructor, Kryo with registration off. Messages, task payloads and stored task state come from other agents and clients, so a gadget chain becomes remote code execution. Severity: critical for Java serialization, XMLDecoder, Jackson default typing and XStream; high for @JsonTypeInfo class names, SnakeYAML and Kryo.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-AF-22 |
| Severity | Critical |
| Category | Agent Network Security |
Remediation
Use plain data binding to concrete types (Jackson without default typing, or with a BasicPolymorphicTypeValidator allowlist and @JsonSubTypes), set an ObjectInputFilter allowlist, configure XStream allowTypes, and construct SnakeYAML with SafeConstructor.