Deserialization Vulnerability Remediation with Automated Gadget Chain Discovery

on YouTube ↗32m

" summary

Claims an approach that automatically finds real exploitable chains across an entire Java classpath and ships as a FOSS toolkit called Gadget Inspector. It analyzes bytecode with simple symbolic execution, reports sequences of method calls from magic deserialization entry points (e.g. equals via HashMap), and finds deep surprises—a 12‑step gadget spanning seven libraries, RC E chains in the closure library, and RCE reachable in ~30 minutes against an app with a 200MB classpath using Jackson.

AI-written summary · about

" chapters (17)

1. 0:00Intro
2. 0:40Deserialization Gadget Chains
3. 2:31What is a Deserialization Vulnerability? In object oriented languages (like Java), data is contained in classes and classes contain code.
4. 7:40Magic Methods? • readObject() and readResolve() are the main ones...
5. 8:26Magic Methods to Gadget Chains
6. 9:55Example Payload
7. 11:51Finding Vulnerabilities • Finding potential vulnerabilities is similar to finding many application security issues
8. 12:32Remediation Options • Why not use a better serialization strategy? "It's 2016, there are better options." -Luca Carettoni
9. 15:01Finding Exploits
10. 19:22Gadget Inspector • Operates on any given classpath, i.e. a particular library or an entire war • Reports discovered gadget chains as a sequence of method invocations • Performs some simplistic symbolic execution to understand possible dataflow from method arguments to subsequent method invocations • Makes a lot of simplifying assumptions that make code analysis easy
11. 20:49How Does It Work?
12. 22:55Deserialization Library Flexibility
13. 24:35New Gadget Chains: Clojure org.clojure clojure 6th most popular maven dependency
14. 25:44New Gadget Chains: Scala
15. 27:24Results: Netflix Internal Webapp 1
16. 29:48Results: Netflix Internal Webapp 2
17. 31:39Final Thoughts • Automatic discovery for gadget chains is new territory

" related talks

• 35mHow To Find The Next Great Deserialization CVEArshan Dabirsiaghi · AppSecUSA 2016
• 34mODDFuzz: Hunting Java Deserialization Gadget Chains via Structure-Aware Directed Greybox FuzzingBiao He, Haowen Mu, Yu Ouyang · Black Hat USA 2023
• 51mNew Exploit Technique In Java Deserialization AttackYongtao Wang, Lucas Zhang, Kunzhe Chai · Black Hat Europe 2019
• 37mDeserialization in Java - is there still anything to fear?Łukasz Mikuła · Oh My H@ck 2020
• 56mThe Anatomy of Java VulnerabilitiesSteve Poole · Voxxed Days Cluj-Napoca 2018
• 49mFixing the Unfixable: Solving Pervasive Vulnerabilities with RASPJeff Williams · OWASP AppSec California 2016
• 49mThe Anatomy of Java VulnerabilitiesSteve Poole · Devoxx Belgium 2017
• 40m[In]secure Deserialization, And How [Not] To Do ItAlexei Kojenov · OWASP Global AppSec Amsterdam 2019