Abstract:

With the widespread adoption of deserialization technology in Java Web application development, attacks exploiting the Java deserialization mechanism have also increased significantly, posing severe threats to the security of Java Web applications. Current mainstream blacklisting defense mechanisms cannot defend against unknown deserialization vulnerabilities, and most existing Java deserialization vulnerability mining tools have low accuracy as they rely on static analysis. This paper proposed a Java deserialization vulnerability mining tool based on fuzzing called DSM-Fuzz. Firstly, DSM-Fuzz performed bidirectional taint analysis on bytecode to extract potential deserialization-related function call chains. Then a TrustRank algorithm-based strategy was used to evaluate relevance between functions and call chains, and allocated energy to seeds accordingly. To optimize syntax and semantics of test cases, this paper designed and implemented a seed mutation algorithm based on deserialization features, utilizing internal Java object information to guide fuzzing strategy to breakthrough vulnerability call chain paths. Experiments show that DSM-Fuzz achieves 90% higher vulnerability code coverage with 50% more detected vulnerabilities in several Java libraries, outperforming other tools. Thus, it can effectively facilitate Java deserialization vulnerability detection.

Key words: Java deserialization vulnerability, fuzzing, taint analysis, vulnerability mining, program call graph