Finding Java deserialization gadgets with CodeQL

Comments, chapters, ... Slides Search
Loading Click here to add:
Subscribe to notifications

When subscribed to notifications, an email will be sent to you for all added annotations.

Your user account has no email address.

Information on this media

81 views

Arbitrary object deserialisation vulnerability in Java applications can be really dangerous, but also worthless if you are not able to find a gadget chain. Some gadgets chains are known and can be used without much consideration, but most of them don't work anymore. Indeed, most known gadgets are 3 or 5 year olds. This can be explained by the fact that finding such chains is hard and few tools exist to automate this process. In this talk I want to present a new technique to easily find new gadgets by leveraging the power of CodeQL. CodeQL is a very powerful static code analyzer that provides a way to analyze code by querying it like a data store. It's open source and can work on open source projects as it requires the source code of the analysed application. CodeQL can find paths between different methods and calls inside an application. This is really useful for gadget chain as we need to look for code paths from a deserialization method to a dangerous one which can lead to arbitrary code execution.

 

Hugo Vincent

I'm a pentester at Synacktiv

Creation date: July 6, 2022
Speakers: Hugo Vincent
License: CC BY-SA v4
Links:

Other media in the channel "2022"