信息网络安全

信息网络安全 ›› 2025, Vol. 25 ›› Issue (1): 1-12.doi: 10.3969/j.issn.1671-1122.2025.01.001

• 理论研究 • 上一篇    下一篇

基于模糊测试的Java反序列化漏洞挖掘

王鹃1,2(), 张勃显1,2, 张志杰1,2, 谢海宁1,2, 付金涛3, 王洋3   

  1. 1.武汉大学国家网络安全学院，武汉 430072
    2.空天信息安全与可信计算教育部重点实验室，武汉 430072
    3.山东浪潮科学研究院有限公司，济南 250013
  • 收稿日期:2024-05-15 出版日期:2025-01-10 发布日期:2025-02-14
  • 通讯作者: 王鹃 E-mail:jwang@whu.edu.cn
  • 作者简介:王鹃（1976—），女，湖北，教授，博士，CCF高级会员，主要研究方向为系统与可信计算、人工智能安全与漏洞挖掘|张勃显（1999—），男，安徽，硕士研究生，主要研究方向为软件安全、可信计算|张志杰（1998—），男，山东，硕士，主要研究方向为软件安全、漏洞挖掘|谢海宁（2001—），男，浙江，硕士研究生，主要研究方向为可信计算、系统安全|付金涛（1979—），男，山东，高级工程师，硕士，主要研究方向为数据安全、工业互联网|王洋（1987—），男，山东，高级工程师，硕士，主要研究方向为隐私计算、零信任和数据安全架构
  • 基金资助:
    国家自然科学基金(61872430)

Java Deserialization Vulnerability Mining Based on Fuzzing

WANG Juan1,2(), ZHANG Boxian1,2, ZHANG Zhijie1,2, XIE Haining1,2, FU Jintao3, WANG Yang3   

  1. 1. School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China
    2. Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, Wuhan 430072, China
    3. Shandong Inspur Science Research Institute Co., Ltd., Jinan 250013, China
  • Received:2024-05-15 Online:2025-01-10 Published:2025-02-14
  • Contact: WANG Juan E-mail:jwang@whu.edu.cn

RichHTML

19

PDF (PC)

57

摘要：

随着反序列化技术在Java Web应用开发中的广泛应用，针对Java反序列化机制的攻击也日益增多，已严重威胁Java Web应用的安全性。当前主流的黑名单防范机制无法有效防御未知的反序列化漏洞利用，而现有的Java反序列化漏洞挖掘工具大多依赖静态分析方法，检测精确度较低。文章提出一种基于模糊测试的Java反序列化漏洞挖掘工具DSM-Fuzz，该工具首先通过对字节码进行双向追踪污点分析，提取所有可能与反序列化相关的函数调用链。然后，利用基于TrustRank算法的函数权值分配策略，评估函数与反序列化调用链的关联性，并根据相关性权值对模糊测试种子分配能量。为进一步优化测试用例的语法结构和语义特征，文章设计并实现了一种基于反序列化特征的种子变异算法。该算法利用反序列化的Java对象内部特征优化种子变异过程，并引导模糊测试策略对反序列化漏洞调用链进行路径突破。实验结果表明，DSM-Fuzz在漏洞相关代码覆盖量方面较其他工具提高了约90%。此外，该工具还在多个主流Java库中成功检测出50%的已知反序列化漏洞，检测精确度显著优于其他漏洞检测工具。因此，DSM-Fuzz可有效辅助Java反序列化漏洞的检测和防护。

关键词: Java反序列化漏洞, 模糊测试, 污点分析, 漏洞挖掘, 程序调用图

Abstract:

With the widespread adoption of deserialization technology in Java Web application development, attacks exploiting the Java deserialization mechanism have also increased significantly, posing severe threats to the security of Java Web applications. Current mainstream blacklisting defense mechanisms cannot defend against unknown deserialization vulnerabilities, and most existing Java deserialization vulnerability mining tools have low accuracy as they rely on static analysis. This paper proposed a Java deserialization vulnerability mining tool based on fuzzing called DSM-Fuzz. Firstly, DSM-Fuzz performed bidirectional taint analysis on bytecode to extract potential deserialization-related function call chains. Then a TrustRank algorithm-based strategy was used to evaluate relevance between functions and call chains, and allocated energy to seeds accordingly. To optimize syntax and semantics of test cases, this paper designed and implemented a seed mutation algorithm based on deserialization features, utilizing internal Java object information to guide fuzzing strategy to breakthrough vulnerability call chain paths. Experiments show that DSM-Fuzz achieves 90% higher vulnerability code coverage with 50% more detected vulnerabilities in several Java libraries, outperforming other tools. Thus, it can effectively facilitate Java deserialization vulnerability detection.

Key words: Java deserialization vulnerability, fuzzing, taint analysis, vulnerability mining, program call graph

中图分类号: