网络与信息安全学报 ›› 2022, Vol. 8 ›› Issue (2): 160-174.doi: 10.11959/j.issn.2096-109x.2022009

• 学术论文 • 上一篇    下一篇

基于混合分析的Java反序列化利用链挖掘方法

武永兴, 陈力波, 姜开达   

  1. 上海交通大学网络空间安全学院，上海 200240
  • 修回日期:2022-01-06 出版日期:2022-04-15 发布日期:2022-04-01
  • 作者简介:武永兴（1997− ），男，安徽亳州人，上海交通大学硕士生，主要研究方向为自动化代码审计、Web安全
    陈力波（1985− ），男，江西广丰人，上海交通大学工程师，主要研究方向为软件与系统安全、物联网安全、虚拟化安全等
    姜开达（1980− ），男，安徽池州人，上海交通大学高级工程师，主要研究方向为网络信息安全、安全漏洞挖掘、网络流量监测
  • 基金资助:
    国家重点研发计划(2019QY0703);上海市科委高新技术领域项目(20511102002)

Java deserialization gadget chain discovery method based on hybrid analysis

Yongxing WU, Libo CHEN, Kaida JIANG   

  1. School of Cyber Science and Engineering, Shanghai Jiao Tong University, Shanghai 200240, China
  • Revised:2022-01-06 Online:2022-04-15 Published:2022-04-01
  • Supported by:
    The National Key R＆D Program of China(2019QY0703);Science and Technology Commission of Shang-hai Municipality Research Program(20511102002)

在线阅读

121

pdf下载

1024

摘要：

Java 反序列化漏洞已经成为当下 Java 应用安全的常见威胁，其中能够找到反序列化利用链是该类型漏洞能否利用的关键。由于Java应用及依赖库的代码空间大和Java本身多态的问题，人工分析Java反序列化利用链，需消耗大量的时间和精力，且高度依赖分析人员的经验知识。因此，研究如何高效且准确地自动化挖掘反序列化利用链至关重要。提出了基于混合分析的 Java 反序列化利用链挖掘方法。根据变量声明类型构造调用图，通过调用图分析筛选可能到达危险函数的反序列化入口函数。将筛选出的入口函数作为混合信息流分析的入口，开展同时面向指针和污点变量的混合信息流分析，对隐式创建的对象标记污点，在传播指针信息的同时传播污点信息，构建混合信息流图。基于混合信息流图判断外部污点数据传播到危险函数的可达性。根据污点传播路径构造相应的反序列化利用链。混合分析兼顾了调用图分析的速度和混合信息流分析的精度。基于提出的混合分析方法，实现相应的静态分析工具——GadgetSearch。GadgetSearch在Ysoserial、Marshalsec、Jackson历史CVE、XStream历史CVE4个数据集上的误报率和漏报率比现有的工具GadgetInspector低，并且发现多条未公开利用链。实验结果证明，所提方法能够在多个实际Java应用中高效且准确地挖掘Java反序列化利用链。

关键词: 反序列化漏洞, 指针分析, 污点分析, 混合分析

Abstract:

Java deserialization vulnerabilities have become a common threat to Java application security nowadays.Finding out the gadget chain determines whether this type of vulnerability can be exploited.Due to the large code space of Java applications and dependent libraries and the polymorphism of Java itself, manual analysis of Java deserialization gadget chains consumes a lot of time and effort and it is highly dependent on the experienced knowledge.Therefore, it is crucial to study how to efficiently and accurately automate the discovery of gadget chains.Java deserialization gadget chain discovery method based on hybrid analysis was proposed.Call graph based on the variable declaration type was constructed, and then the deserialization entry functions that may reach the dangerous functions were screened using the call graph analysis.The screened entry functions were used as the entry point of the hybrid information flow analysis.The hybrid information flow analysis was carried out for both pointer and tainted variables.The tainted objects created implicitly were marked.The tainted information and the pointer information were propagated simultaneously to construct the hybrid information flow graph.The reachability of external taint data propagation to the dangerous function was judged based on the hybrid information flow graph.The corresponding deserialization gadget chain was constructed according to the taint propagation path.The hybrid analysis took into account the efficiency of call graph analysis and the accuracy of hybrid information flow analysis.The corresponding static analysis tool, namely GadgetSearch, was implemented based on the proposed hybrid analysis method.In the experimental evaluation, GadgetSearch had lower false positive and lower false negative than the existing tool GadgetInspector on four datasets of Ysoserial, Marshalsec, Jackson historical CVE, and XStream historical CVE.Additionally, GadgetSearch also found multiple undisclosed gadget chains.The experimental results show that the proposed method can efficiently and accurately discover the Java deserialization gadget chain in multiple practical Java applications.

Key words: deserialization vulnerability, pointer analysis, taint analysis, hybrid analysis

中图分类号: 

No Suggested Reading articles found!