一句话：提出首个 Java Web 框架数据绑定漏洞自动检测工具 DIVER，在 Spring 与 Grails 中发现 81 个漏洞并获 3 个 CVE。
数据绑定因能自动将 Web 请求参数绑定到程序属性而被主流 Web 框架广泛采用，但实现不当会暴露敏感属性，形成数据绑定漏洞，可被利用发起如 Spring4Shell 远程代码执行等严重攻击。现有工作缺乏对此类问题的系统研究。本文首次对 Java Web 框架中的数据绑定漏洞进行自动化分析，提出检测工具 DIVER，包含三项新技术：基于嵌套属性图的提取以获取嵌套属性，基于绑定点插桩的识别以判定可绑定的嵌套属性，以及属性感知 fuzzing 以触发并检测漏洞。作者在 Spring 和 Grails 两个广泛使用的框架上评估 DIVER，共发现 81 个数据绑定漏洞，可导致远程代码执行、任意文件读取和拒绝服务攻击，并已负责任地报告和协助修复，获得三个严重与高危级别的新 CVE，包括著名的 Spring4Shell。
Data binding has been widely adopted by popular web frameworks due to its convenience of automatically binding web request parameters to the web program's properties. However, its improper implementation in web frameworks exposes sensitive properties, leading to data binding vulnerabilities, which can be exploited to launch severe attacks, such as the Spring4Shell remote code execution. Despite their criticalness, these issues are overlooked, and there is no systematic study addressing them. This paper presents the first automatic analysis of the data binding vulnerabilities in Java web frameworks. We develop an automatic Data bInding Vulnerabilities dEtectoR, named DIVER, to analyze data binding vulnerabilities. DIVER employs three new techniques: the Nested Property Graph-based Extraction to extract nested properties, the Bind-Site Instrumentation-based Identification to identify bindable nested properties, and the Property-aware Fuzzing to trigger and detect data binding vulnerabilities. We evaluated DIVER on two widely used Java web frameworks, Spring and Grails, and discovered 81 data binding vulnerabilities. These vulnerabilities can be exploited to launch remote code execution, arbitrary file read, and denial of service attacks. We have responsibly reported these vulnerabilities to the corresponding teams and helped to fix them. Three new CVEs with critical and high severity ratings have been assigned to us, including the infamous Spring4Shell.
DOI 原文 ·
@inproceedings{paperbot8473,
title = {Automated Data Binding Vulnerability Detection for Java Web Frameworks via Nested Property Graph},
author = {Xiaoyong Yan and Biao He and Wenbo Shen and Yu Ouyang and Kaihang Zhou and Xingjian Zhang and Xingyu Wang and Yukai Cao and Rui Chang},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680367}
}