一句话：提出结合静态分析与 fuzzing 的混合方法，利用堆抽象引导 fuzzing 检测 Java 库序列化漏洞并验证静态分析报告。
Java 序列化相关安全漏洞在众多应用中被反复报告。由于序列化问题给静态分析同时带来可靠性与精度挑战，分析工具难以在 Java 库中精确定位序列化漏洞。本文提出一种混合分析方法：在静态分析基础上引入 fuzzing，并利用堆抽象引导 fuzzing 生成更有针对性的输入，从而快速、有效地产生结果，同时自动验证静态分析报告。作者在 Apache Commons Collections 库上评估该方法，能够检测出已知的序列化漏洞，表明该混合思路具有应用潜力。
Serialisation related security vulnerabilities have recently been reported for numerous Java applications. Since serialisation presents both soundness and precision challenges for static analysis, it can be difficult for analyses to precisely pinpoint serialisation vulnerabilities in a Java library. In this paper, we propose a hybrid approach that extends a static analysis with fuzzing to detect serialisation vulnerabilities. The novelty of our approach is in its use of a heap abstraction to direct fuzzing for vulnerabilities in Java libraries. This guides fuzzing to produce results quickly and effectively, and it validates static analysis reports automatically. Our approach shows potential as it can detect known serialisation vulnerabilities in the Apache Commons Collections library.
DOI 原文 ·
@inproceedings{paperbot6002,
title = {A hybrid analysis to detect Java serialisation vulnerabilities},
author = {Shawn Rasheed and Jens Dietrich},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3418931}
}