一句话：揭示鸭子类型误用会扩大动态语言反序列化漏洞的攻击面，并实现静态分析工具 GrayDuck 检测误用与评估危害。
鸭子类型在动态语言中广泛使用，但误用可能带来安全威胁。本文揭示鸭子类型如何加剧反序列化漏洞影响并扩大攻击者可选攻击范围，给出三类鸭子类型误用案例，并从理论上说明其如何扩大反序列化漏洞攻击面。作者设计静态分析工具 GrayDuck，通过构建类关系图（CRG）刻画每次反序列化操作可访问的类范围，识别鸭子类型误用实例及关联攻击面，以评估潜在危害。在 5 个已知存在真实反序列化漏洞的 Python 程序上扫描，共检测到 7 处反序列化对象鸭子类型误用，并计算了对应的攻击面扩展。
Duck typing is a flexible programming style in dynamic languages, enabling the achievement of complex behaviors using less code. The use of duck typing is currently widespread; however, the question is whether its use in code is truly safe. In fact, improper use of duck typing may introduce unexpected security threats. In this paper, we reveal another side of duck typing, showing how it can exacerbate the impact of deserialization vulnerabilities and expand the range of attack options for attackers. We present three cases of duck typing misuse and theoretically demonstrate how such misuse can expand the attack surface of deserialization vulnerabilities. Additionally, we design a static analysis tool, GrayDuck, to construct a Class Relation Graph (CRG) that clearly delineates the range of classes accessible through each deserialization operation and identify instances of duck typing misuse along with the associated attack surfaces so that to assess the potential harm. We utilized this tool to scan 5 Python programs known to have real deserialization vulnerabilities, detecting 7 issues of deserialized object duck typing misuse and calculating the corresponding expansions of the attack surfaces.
DOI 原文 ·
@inproceedings{paperbot8282,
title = {GrayDuck: The Sword of Damocles for Duck Typing in Dynamic Language Deserialization},
author = {Xiaofan Liu and Xunjin Zheng and Cai Fu and Xiaoheng Xie and Peng Di},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695327}
}