基于运行时检测的Java反序列化漏洞防御技术

李玉林; 陈力波; 刘宇江; 杜文龙; 薛质

doi:10.11959/j.issn.2096-109x.2024021

您当前的位置：

首页 >

文章列表页 >

基于运行时检测的Java反序列化漏洞防御技术

学术论文 | 更新时间：2024-08-14

- 基于运行时检测的Java反序列化漏洞防御技术
- Java deserialization vulnerability defense technologybased on run-time detection
- 网络与信息安全学报 2024年10卷第2期页码：154-164
- 作者机构：
  
  1.上海交通大学网络空间安全学院，上海 200240
  2.蚂蚁科技集团股份有限公司，浙江杭州 310063
- 作者简介：
  
  [ "李玉林（1990- ），男，安徽阜阳人，上海交通大学硕士生，主要研究方向为Web安全、Iot设备安全。" ]
  [ "陈力波（1985- ），男，江西广丰人，上海交通大学高级工程师、硕士生导师，主要研究方向为软件与系统安全、物联网安全、虚拟化安全。" ]
  [ "刘宇江（1990- ），男，江西樟树人，蚂蚁集团高级安全专家，主要研究方向为企业安全架构、安全基础设施、网络安全攻防对抗、数据安全治理体系。" ]
  [ "杜文龙（1994- ），男，安徽宿州人，上海交通大学硕士生，主要研究方向为设备的漏洞挖掘与利用。" ]
  [ "薛质（1971- ），男，江苏常州人，上海交通大学教授、博士生导师，主要研究方向为计算机通信网、网络攻防与评测、安全主动网。" ]
- 基金信息：
  
  国家自然科学基金(62372297;62272306);国家广播电视总局实验室项目(FYY20230001ZSB011)
- DOI：10.11959/j.issn.2096-109x.2024021
  中图分类号： TP393
- 收稿：2023-07-12，
  
  修回：2024-03-05，
  
  纸质出版：2024-04-15
- 稿件说明：
移动端阅览
李玉林, 陈力波, 刘宇江, 等. 基于运行时检测的Java反序列化漏洞防御技术[J]. 网络与信息安全学报, 2024, 10(02): 154-164.

Format: LI Y L, CHEN L B, LIU Y J, et al. Java deserialization vulnerability defense technologybased on run-time detection[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 154-164.
李玉林, 陈力波, 刘宇江, 等. 基于运行时检测的Java反序列化漏洞防御技术[J]. 网络与信息安全学报, 2024, 10(02): 154-164. DOI： 10.11959/j.issn.2096-109x.2024021.

Format: LI Y L, CHEN L B, LIU Y J, et al. Java deserialization vulnerability defense technologybased on run-time detection[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 154-164. DOI： 10.11959/j.issn.2096-109x.2024021.

摘要

反序列化漏洞自被发现以来，便受到安全研究者的广泛关注，越来越多的漏洞被爆出，给企业的网络安全带来严重挑战。Java语言多态、反射等特性，导致其反序列化漏洞利用链更加多变和复杂，带来了更大的防御和检测难度。因此，研究如何防御Java反序列化漏洞攻击，成为网络防御的重要环节。通过对公开的众多Java反序列化漏洞进行研究，提出了基于运行时检测的Java反序列化漏洞防御技术方案。根据反序列化数据类型，将反序列化漏洞分为Java原生反序列化漏洞、JSON反序列化漏洞、XML反序列化漏洞、YAML反序列化漏洞4种类型，并针对每种类型的反序列化漏洞、归纳其漏洞利用过程中的反序列化入口函数；通过Java的运行时保护技术，对Java底层的敏感行为如命令执行进行监控，获取系统当前的运行时上下文信息；通过在上下文信息中匹配漏洞利用中的反序列化入口函数，来判断当前行为是否为反序列化漏洞的利用行为。在多个Java应用（如WebLogic、JBoss、Jenkins等）的测试结果表明，该方案能有效地对Java反序列化漏洞攻击行为进行防御，且不会对目标系统性能产生较大的影响。同时，在与其他主流防护方案的比较中，该方法显示出更好防护效果。

Abstract

The discovery of deserialization vulnerabilities has garnered significant attention from cybersecurity researchers

with an increasing number of vulnerabilities being uncovered

posing severe threats to enterprise network security. The Java language's polymorphism and reflection capabilities render its deserialization vulnerability exploitation chains more varied and intricate

amplifying the challenges in defense and detection efforts. Consequently

developing strategies to counter Java deserialization vulnerability attacks has become a critical aspect of network security. Following an examination of numerous publicly known Java deserialization vulnerabilities

a runtime detection-based defense technology solution for Java deserialization vulnerabilities was proposed. Deserialization vulnerabilities were categorized into four types based on the data formats involved: Java native deserialization vulnerability

JSON deserialization vulnerability

XML deserialization vulnerability

and YAML deserialization vulnerability. For each type

the entry function within the exploitation process was identified and summarized. Utilizing Java's runtime protection technology

the solution monitored sensitive behaviors

such as command execution at the Java level

and captured the current runtime context information of the system. By correlating the deserialization entry function with the context information

the system can determine if the current behavior constitutes an exploitation of a deserialization vulnerability. The solution's efficacy was validated through testing on prevalent Java applications

including WebLogic

JBoss

and Jenkins. The results demonstrate that this approach can effectively protect against Java deserialization vulnerability attacks without inflicting a substantial performance penalty on the targeted system. Furthermore

when compared to other mainstream protection solutions

this method exhibits superior protective efficacy.

关键词

Keywords

references

LAWRENCE G . Marshalling pickles [EB ] . 2015 .

MUNOZ A . Friday the 13th: JSON attacks [EB ] . 2017 .

王柏柱 . 基于代码属性图的Java反序列化利用链检测技术研究 [D ] . 北京 : 中国科学院大学 , 2021 .

WANG B Z . Research on Java deserialization utilization chain detection technology based on code attribute graph [D ] . Beijing : University of Chinese Academy of Sciences , 2021 .

武永兴 , 陈力波 , 姜开达 . 基于混合分析的Java反序列化利用链挖掘方法 [J ] . 网络与信息安全学报 , 2022 , 8 ( 2 ): 160 - 174 .

WU Y X , CHEN L B , JIANG K D . Java deserialization gadget chain discovery method based on hybrid analysis [J ] . Chinese Journal of Network and Information Security . 2022 , 8 ( 2 ): 160 - 174 .

TRIPP O , PISTOIA M , FINK S J , et al . TAJ [J ] . ACM SIGPLAN Notices , 2009 , 44 ( 6 ): 87 - 97 .

HUANG W , DONG Y , MILANOVA A . Type-based taint analysis for Java web applications [C ] // Proceedings of the International Conference on Fundamental Approaches to Software Engineering . Berlin : Springer , 2014 : 140 - 154 .

SRIDHARAN M , ARTZI S , PISTOIA M , et al . F4F: taint analysis of framework-based web applications [C ] // Proceedings of the 2011 ACM international Conference on object Oriented Programming Systems Languages and Applications . New York : ACM press , 2011 : 1053 - 1068 .

LERCH J , HERMANN B , BODDEN E , et al . FlowTwist: efficient context-sensitive inside-out taint analysis for large codebases [C ] // Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering . New York : ACM press , 2014 : 98 - 108 .

王蕾 , 李丰 , 李炼 , 等 . 污点分析技术的原理和实践应用 [J ] . 软件学报 , 2017 , 28 ( 4 ): 860 - 882 .

WANG L , LI F , LI L , et al . Principle and practice of taint analysis [J ] . Journal of Software . 2017 , 28 ( 4 ): 860 - 882 .

CAO S C , HE B , SUN X B , et al . ODDFuzz: discovering Java deserialization vulnerabilities via structure-aware directed greybox fuzzing [C ] // Proceedings of the 2023 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2023 : 2726 - 2743 .

HUANG Y W , YU F , HANG C , et al . Securing web application code by static analysis and runtime protection [C ] // Proceedings of the 13th International Conference on World Wide Web . New York : ACM press , 2004 : 40 - 52 .

AMOROSO E . Recent progress in software security [J ] . IEEE Software . 2018 , 35 ( 2 ): 11 - 13 .

SETH A , BHATTACHARYA S , ELDER S , et al . Comparing effectiveness and efficiency of interactive Application Security testing (IAST) and runtime application self-protection (RASP) tools in ALarge java-based system [J ] . SSRN Electronic Journal , 2022 . 43 - 44 .

ČISAR P , ČISAR S M . The framework of runtime application self-protection technology [C ] // Proceedings of the 2016 IEEE 17th International Symposium on Computational Intelligence and Informatics (CINTI) . Piscataway : IEEE Press , 2016 : 81 - 86 .

奚阳 . Java程序运行时保护与监控技术研究 [D ] . 南京 : 南京大学 , 2008 .

XI Y . Research on runtime protection and monitoring technology of Java programs [D ] . Nanjing : Nanjing University , 2008 .

何作鑫 . 基于RASP的Webshell检测程序设计与实现 [D ] . 重庆 : 西南大学 , 2022 .

HE Z X . Design and implementation of Webshell detection program based on RASP [D ] . Chongqing : Southwest University , 2022 .

BINDER W , HULAAS J , MORET P . Advanced Java bytecode instrumentation [C ] // Proceedings of the 5th International Symposium on Principles and Practice of Programming in Java . New York : ACM , 2007 : 135 - 144 .

MASTRANGELO L , HAUSWIRTH M . JNIF: Java native instrumentation framework [C ] // Proceedings of the Proceedings of the 2014 International Conference on Principles and Practices of Programming on the Java Platform: Virtual Machines, Languages, and Tools . New York : ACM press , 2014 : 194 - 199 .

BINDER W , HULAAS J , MORET P . A quantitative evaluation of the contribution of native code to Java workloads [C ] // Proceedings of the 2006 IEEE International Symposium on Workload Characterization . Piscataway : IEEE Press , 2006 : 201 - 209 .

余航 , 王帅 , 金华敏 . 基于RASP的Web安全检测方法 [J ] . 电信科学 , 2020 , 36 ( 11 ): 113 - 120 .

YU H , WANG S , JIN H M . RASP based Web security detection method [J ] . Telecommunications Science , 2020 , 36 ( 11 ): 113 - 120 .

邱若男 , 胡岸琪 , 彭国军 , 等 . 基于RASP技术的Java Web框架漏洞通用检测与定位方案 [J ] . 武汉大学学报(理学版) , 2020 , 66 ( 3 ): 285 - 296 .

QIU R N , HU A Q , PENG G J , et al . A general detection and location scheme for Java Web framework vulnerability based on RASP technology [J ] . Journal of Wuhan University (Natural Science Edition) . 2020 , 66 ( 3 ): 285 - 296 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于混合分析的Java反序列化利用链挖掘方法