Abstract:Java deserialization vulnerabilities have become a common threat to Java application security nowadays.Finding out the gadget chain determines whether this type of vulnerability can be exploited.Due to the large code space of Java applications and dependent libraries and the polymorphism of Java itself, manual analysis of Java deserialization gadget chains consumes a lot of time and effort and it is highly dependent on the experienced knowledge.Therefore, it is crucial to study how to efficiently and accurately automate the discovery of gadget chains.Java deserialization gadget chain discovery method based on hybrid analysis was proposed.Call graph based on the variable declaration type was constructed, and then the deserialization entry functions that may reach the dangerous functions were screened using the call graph analysis.The screened entry functions were used as the entry point of the hybrid information flow analysis.The hybrid information flow analysis was carried out for both pointer and tainted variables.The tainted objects created implicitly were marked.The tainted information and the pointer information were propagated simultaneously to construct the hybrid information flow graph.The reachability of external taint data propagation to the dangerous function was judged based on the hybrid information flow graph.The corresponding deserialization gadget chain was constructed according to the taint propagation path.The hybrid analysis took into account the efficiency of call graph analysis and the accuracy of hybrid information flow analysis.The corresponding static analysis tool, namely GadgetSearch, was implemented based on the proposed hybrid analysis method.In the experimental evaluation, GadgetSearch had lower false positive and lower false negative than the existing tool GadgetInspector on four datasets of Ysoserial, Marshalsec, Jackson historical CVE, and XStream historical CVE.Additionally, GadgetSearch also found multiple undisclosed gadget chains.The experimental results show that the proposed method can efficiently and accurately discover the Java deserialization gadget chain in multiple practical Java applications.

A Static Method to Discover Deserialization Gadget Chains in Java Programs.

Java Deserialization Gadget Chain Discovery Method Based on Hybrid Analysis

Improving Java Deserialization Gadget Chain Mining via Overriding-Guided Object Generation

Efficient Detection of Java Deserialization Gadget Chains Via Bottom-up Gadget Search and Dataflow-aided Payload Construction

ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing

Java Deserialization Vulnerability Defense Technologybased on Run-Time Detection

Vulnerability Detection For Smart Grid Devices Via Static Analysis

Improving Precision of Detecting Deserialization Vulnerabilities with Bytecode Analysis.

Unveiling the Invisible: Detection and Evaluation of Prototype Pollution Gadgets with Dynamic Taint Analysis

Supporting secure programming in web applications through interactive static analysis.

Automated Data Binding Vulnerability Detection for Java Web Frameworks Via Nested Property Graph

Exception-Chain Analysis: Revealing Exception Handling Architecture in Java Server Applications

GHunter: Universal Prototype Pollution Gadgets in JavaScript Runtimes

Comprehensive Evaluation of Static Analysis Tools for Their Performance in Finding Vulnerabilities in Java Code

Automatic Policy Synthesis and Enforcement for Protecting Untrusted Deserialization

SBOM.EXE: Countering Dynamic Code Injection based on Software Bill of Materials in Java

On the Security Blind Spots of Software Composition Analysis

Java-Class-Hijack: Software Supply Chain Attack for Java based on Maven Dependency Resolution and Java Classloading

Seneca: Taint-Based Call Graph Construction for Java Object Deserialization

A Full Automatic Detection Method for Security Policy of JVM Run-Time Library

Evaluation of Static Vulnerability Detection Tools with Java Cryptographic API Benchmarks