Rev Gadget: A Java Deserialization Gadget Chains Discover Tool Based on Reverse Semantics and Taint Analysis

Java is a widely utilized object-oriented programming language known for its powerful cross-platform features. The object serialization mechanism in Java enables the persistence and propagation of objects over the network. However, this capability also introduces deserialization vulnerabilities. Java deserialization vulnerabilities arise when an application has a deserialization entry point. Attackers can exploit this by constructing malicious serialized data, leading to the invocation of dangerous methods and resulting in issues such as command execution and information leakage. The malicious serialized data typically consists of a series of method gadget chains, commonly referred to as ’gadget chains.’To mitigate deserialization vulnerabilities, it is crucial to discover and understand the gadget chains within a program. This article introduces a tool named Rev Gadget, designed for discovering Java deserialization gadget chains. The tool employs reverse semantics and taint analysis for this purpose. The process begins with static analysis using CodeQL to identify entry and dangerous methods. Subsequently, reverse semantics are defined, and taint analysis is utilized to uncover potential deserialization gadget chains. Comparative experiments conducted using Gadget Inspector demonstrate that Rev Gadget exhibits superior detection rates, accuracy, and overall performance.