Dynamic Code Evaluation: Unsafe Deserialization Fortify Issue

Question

I am getting the Fortify issue:

Dynamic Code Evaluation: Unsafe Deserialization

on the below line:

rapidMtoorderObj = (MyMessageObject)theMessage.getObject(); 

I have attached my JMS code snippet. Can anyone please check my JMS code and please explain why am I getting the issue and share the fix.

import javax.jms.JMSException;
import javax.jms.Message;
import javax.jms.ObjectMessage;

public class MyMessageBean extends MessageReceiver {
   private static final long serialVersionUID = 1L;

   public MyMessageBean() { 
       super();
   }

   public void onMessage(Message message) {
      MyMessageObject rapidMtoorderObj = new MyMessageObject(); 

      try {  
         ObjectMessage theMessage = (ObjectMessage)message;
         rapidMtoorderObj = (MyMessageObject)theMessage.getObject(); 
         // Getting "Dynamic Code Evaluation: Unsafe Deserialization" in this line 

      }
   }
}

Answer 1

ObjectMessage objects depend on Java serialization to marshal and unmarshal their object payload. This process is generally considered unsafe, because a malicious payload can exploit the host system. Lots of CVEs have been created for this. For this reason, most JMS providers force users to explicitly whitelist packages that can be exchanged using ObjectMessage messages. For example, here's the related documentation for ActiveMQ Artemis.

There is no magic code fix for this issue that will eliminate the warning from Fortify aside from removing the use of ObjectMessage from your code altogether (which is what I would actually recommend).

There are a number of other issues with using JMS ObjectMessage not related to security that you should read about.