一句话：提出结合静态与动态分析的混合框架，自动发现 Java 反序列化利用链漏洞。
论文关注序列化/反序列化在分布式应用中引入的安全风险：攻击者可构造恶意字节流，滥用反序列化逻辑强制调用攻击者控制的方法。Crystallizer 提出混合路径分析框架，先通过静态分析过近似可能 payload 以约束搜索空间，再用动态分析实例化具体 payload，作为漏洞概念验证，为分析人员提供可操作攻击示例。作者以 Java 反序列化为主，原型在七个流行 Java 库上评估，与现有 gadget chain 发现框架相比，发现 41 条此前未知的可利用链；并据此对三个流行 Java 应用合成 gadget chain，实现 RCE 与 DoS，证明真实影响，所有漏洞均已负责任披露。
Applications use serialization and deserialization to exchange data. Serialization allows developers to exchange messages or perform remote method invocation in distributed applications. However, the application logic itself is responsible for security. Adversaries may abuse bugs in the deserialization logic to forcibly invoke attacker-controlled methods by crafting malicious bytestreams (payloads). Crystallizer presents a novel hybrid framework to automatically uncover deserialization vulnerabilities by combining static and dynamic analyses. Our intuition is to first over-approximate possible payloads through static analysis (to constrain the search space). Then, we use dynamic analysis to instantiate concrete payloads as a proof-of-concept of a vulnerability (giving the analyst concrete examples of possible attacks). Our proof-of-concept focuses on Java deserialization as the imminent domain of such attacks. We evaluate our prototype on seven popular Java libraries against state-of-the-art frameworks for uncovering gadget chains. In contrast to existing tools, we uncovered 41 previously unknown exploitable chains. Furthermore, we show the real-world security impact of Crystallizer by using it to synthesize gadget chains to mount RCE and DoS attacks on three popular Java applications. We have responsibly disclosed all newly discovered vulnerabilities.
@inproceedings{SrivastavaTV0BP23,
title = {Crystallizer: A Hybrid Path Analysis Framework to Aid in Uncovering Deserialization Vulnerabilities},
author = {Prashast Srivastava and Flavio Toffalini and Kostyantyn Vorobyov and François Gauthier and Antonio Bianchi and Mathias Payer},
booktitle = {FSE},
year = {2023},
doi = {10.1145/3611643.3616313}
}