SerdeSniffer: Enhancing Java Deserialization Vulnerability Detection with Function Summaries

Java deserialization vulnerabilities arise when unexpected data triggers dangerous function calls during deserialization processes. Current deserialization vulnerability detection faces challenges such as path explosion caused by polymorphism [29] in Java, leading to incomplete analysis and inefficiency. In this paper, we present SerdeSniffer, a new Java deserialization vulnerability detection tool to address these challenges. SerdeSniffer is the first tool that employs a bottom-up function summarization technique to mitigate path explosion effectively. Specifically, SerdeSniffer uses function summaries during interprocedural analysis to effectively prevent multiple calculations in taint analysis and utilizes fixpoint computation to analyze issues related to function recursion and cyclic calls. To avoid omissions in summary information, we use the over-tainting method in taint analysis and treat uninitialized variables as taint sources. We also merge the summary information of called functions to facilitate polymorphic analysis. Furthermore, SerdeSniffer includes a vulnerability detection algorithm that starts from dangerous functions and uses summary information and propagation rules in a bottom-up approach, and employs a sanitizer to eliminate ineffective propagation paths. In comparative experiments based on ysoserial [23], a tool for generating payloads that exploit Java object deserialization, SerdeSniffer identified nine more historical gadget chains than other open source tools. In testing the latest versions of components, SerdeSniffer discovered three new gadget chains within 600 s, the longest being 14 nodes, two of these new chains confirmed by CVEs in the PUBLISHED state.