ODDFuzz: Hunting Java Deserialization Gadget Chains via Structure-Aware Directed Greybox Fuzzing
No ratings
Presented at BlackHat USA 2023 by
Although the Java deserialization vulnerability has been widely known for many years, it still poses a severe threat to security. The attackers and defenders both focus on hunting gadget chains, which are the key to actually exploiting the vulnerability.There are some available tools that can be used to hunt for gadget chains automatically. Unfortunately, these tools struggle to address the following challenges: (1) Existing tools have difficulty making trade-offs between precision and recall, because runtime polymorphism and other dynamic language features (e.g., reflection, dynamic proxy) are ubiquitous in the Java ecosystem, and the length of gadget chains in Java is longer than other programming languages, which causes huge computation space and amplifies the inaccuracy caused by dynamic features. (2) Existing tools are unable to validate candidate gadget chains, which require manual inspection and are time-consuming and error-prone.We propose a novel approach ODDFuzz to hunt gadget chains efficiently and precisely. First, ODDFuzz performs lightweight static analysis to identify candidate gadget chains. In this step, ODDFuzz tries to locate all candidates and avoid false negatives. Then, ODDFuzz performs directed greybox fuzzing to validate those candidates to mitigate false positives. In this step, we propose a new distance metric that accurately measures the reaching probability of the candidate gadget chain, which is used for seed prioritization and power scheduling during fuzzing. Specifically, ODDFuzz applies a novel structure-aware seed generation method to guarantee the validity of the seeds, and adopts a new property-oriented mutation technique to improve the efficiency of seed mutation, which makes ODDFuzz well-suited under this scenario. As far as we know, ODDFuzz is the first directed greybox fuzzing dedicated to hunting gadget chains. We evaluated ODDFuzz on a set of widely used applications and identified 6 previously unknown gadget chains with 5 CVEs assigned, and well-known affected vendors include Oracle WebLogic Server, Apache Dubbo and Protostuff. In this talk, we will conduct detailed case studies to show how ODDFuzz helped us identify these 0days.