Abstract:Java deserialization vulnerabilities have become a common threat to Java application security nowadays.Finding out the gadget chain determines whether this type of vulnerability can be exploited.Due to the large code space of Java applications and dependent libraries and the polymorphism of Java itself, manual analysis of Java deserialization gadget chains consumes a lot of time and effort and it is highly dependent on the experienced knowledge.Therefore, it is crucial to study how to efficiently and accurately automate the discovery of gadget chains.Java deserialization gadget chain discovery method based on hybrid analysis was proposed.Call graph based on the variable declaration type was constructed, and then the deserialization entry functions that may reach the dangerous functions were screened using the call graph analysis.The screened entry functions were used as the entry point of the hybrid information flow analysis.The hybrid information flow analysis was carried out for both pointer and tainted variables.The tainted objects created implicitly were marked.The tainted information and the pointer information were propagated simultaneously to construct the hybrid information flow graph.The reachability of external taint data propagation to the dangerous function was judged based on the hybrid information flow graph.The corresponding deserialization gadget chain was constructed according to the taint propagation path.The hybrid analysis took into account the efficiency of call graph analysis and the accuracy of hybrid information flow analysis.The corresponding static analysis tool, namely GadgetSearch, was implemented based on the proposed hybrid analysis method.In the experimental evaluation, GadgetSearch had lower false positive and lower false negative than the existing tool GadgetInspector on four datasets of Ysoserial, Marshalsec, Jackson historical CVE, and XStream historical CVE.Additionally, GadgetSearch also found multiple undisclosed gadget chains.The experimental results show that the proposed method can efficiently and accurately discover the Java deserialization gadget chain in multiple practical Java applications.

Automated Data Binding Vulnerability Detection for Java Web Frameworks Via Nested Property Graph

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

Abusing Hidden Properties to Attack the Node.js Ecosystem

XHunter: Understanding XXE Vulnerability via Automatic Analysis

Java Deserialization Vulnerability Defense Technologybased on Run-Time Detection

Vulnerabilities Mapping based on OWASP-SANS: a Survey for Static Application Security Testing (SAST)

BindHost: Comprehensive Vulnerability Scanner Tool

Supporting secure programming in web applications through interactive static analysis.

ODDFUZZ: Discovering Java Deserialization Vulnerabilities via Structure-Aware Directed Greybox Fuzzing

AuthCheck: Program-State Analysis for Access-Control Vulnerabilities

Automated black-box detection of access control vulnerabilities in web applications

Secure Coding Practices in Java: Challenges and Vulnerabilities

Efficient Detection of Java Deserialization Gadget Chains Via Bottom-up Gadget Search and Dataflow-aided Payload Construction

Understanding the Threats of Upstream Vulnerabilities to Downstream Projects in the Maven Ecosystem.

D-WAV: A Web Application Vulnerabilities Detection Tool Using Characteristics of Web Forms

Bidirectional Analysis Method of Static XSS Defect Detection Technique Based On Database Query Language.

Break the Wall from Bottom: Automated Discovery of Protocol-Level Evasion Vulnerabilities in Web Application Firewalls

On the Security Blind Spots of Software Composition Analysis

Access Control Vulnerabilities Detection for Web Application Components

Automated Black-box Testing of Mass Assignment Vulnerabilities in RESTful APIs

Java Deserialization Gadget Chain Discovery Method Based on Hybrid Analysis