How To Find The Next Great Deserialization CVE
summary
Generalizes the recent Java deserialization surge and shows an actually authored exploit that chains a hashCode → ProcessBuilder.start chain to get remote command execution against a real Jenkins CVE, using a purpose-built static analysis tool that scans Maven repos to find immediate gadgets and chaining candidates, demonstrates type stuffing and finalize/constructor gadgets, and reports that the practical remediation applied is type constraints fix (whitelisting allowed classes), which successfully stops the demonstrated attacks.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:50An Old Story: Data Becomes Code
- 2:47What is Deserialization?
- 3:53Deserialization Design Security Choices
- 9:15Object Instantiation Strategies
- 15:13Gadget Chains Expands Gadget Pool
- 24:21Type Stuffing Xstream
- 27:20Deserializer Exploitation Framework
- 31:36Summary
related talks
56mThe Anatomy of Java Vulnerabilities
32mDeserialization Vulnerability Remediation with Automated Gadget Chain Discovery
51mNew Exploit Technique In Java Deserialization Attack
49mThe Anatomy of Java Vulnerabilities
38mHacking Jenkins
49mDeserialization vulns: past, present, and future
23mMight As Well JUMP: Exploit Development For Java Serialization
40m[In]secure Deserialization, And How [Not] To Do It