SlideShare une entreprise Scribd logo
1  sur  50
Télécharger pour lire hors ligne
Alvaro Muñoz, @pwntester
Christian Schneider, @cschneider4711
Surviving the Java Serialization
Apocalypse
JVM
Why this talk?
• Java deserialization attacks have been known for years
– Relatively new gadget in Apache Commons-Collections made the topic
available to a broader audience in 2015
• Some inaccurate advice to protect your applications is making the rounds
– In this talk we’ll demonstrate the weakness of this advice by …
• … showing you new RCE gadgets
• … showing you bypasses
• We’ll give advice how to spot this vulnerability and its gadgets during …
– … code reviews (i.e. showing you what to look for)
– … pentests (i.e. how to generically test for such issues)
2
Quick Poll
3
InputStream is = request.getInputStream();
ObjectInputStream ois = new ObjectInputStream(ois);
ois.readObject();
Deserializing user-controlled data will get you compromised in the worst case …
... and probably will crash your JVM in the best.
Spoiler Alert
JAVA (DE)SERIALIZATION 101
• Taking a snapshot of an object graph as a byte stream
that can be used to reconstruct the object graph to its
original state
• Only object data is serialized, not the code
• The code sits on the Classpath of the deserializing end
4
Object Graph Object Graph
ACED 0005 …
Attack Surface
• Usages of Java serialization
in protocols/formats/products:
– RMI (Remote Method
Invocation)
– JMX (Java Management
Extension)
– JMS (Java Messaging
System)
– Spring Service Invokers
• HTTP, JMS, RMI, etc.
– Android
– AMF (Action Message
Format)
– JSF ViewState
– WebLogic T3
– …
5
Java Deserialization in a Nutshell
6
Serializable Class
6. Restore object member fields

• readObject(ObjectInputStream)
• readObjectNoData()
7. Eventually replace restored object

• readResolve()
8. Optionally validate object

• validateObject()
9. Cast deserialized object to expected type

10.Use deserialized object
ObjectInputStream Application Code Garbage Collector
11.Call finalize() on GC
1. Get bytes

2. Initialize ObjectInputStream

3. Read object from stream

• ois.readObject()
4. Resolve classes of stream
resolveClass()

5. Deserialize objects
ABUSING “MAGIC METHODS”
• Abusing "magic methods" of gadgets which have dangerous code:
• Attacker controls member fields / fields’ values of serialized object
• Upon deserialization .readObject() / .readResolve() is invoked
• Implementation of this method in gadget class uses attacker-controlled fields
• Aside from the classic ones also lesser-known "magic methods" help:
• .validateObject() as part of validation (which does not prevent attacks)
• .readObjectNoData() upon deserialization conflicts
• .finalize() as part of GC (even after errors)
• Works also for Externalizable’s .readExternal()
7
Triggering Execution via "Magic Methods"
8
Serializable Class
6. Restore object member fields

• readObject(ObjectInputStream)
• readObjectNoData()
7. Eventually replace restored object

• readResolve()
8. Optionally validate object

• validateObject()
9. Cast deserialized object to expected type

10.Use deserialized object
ObjectInputStream Application Code Garbage Collector
11.Call finalize() on GC
1. Get bytes

2. Initialize ObjectInputStream

3. Read object from stream

• ois.readObject()
4. Resolve classes of stream
resolveClass()

5. Deserialize objects
public class DangerousToy implements Serializable {
private String command;
…
public final Object readObject(ObjectInputStream ois)
throws OptionalDataException, ClassNotFoundException, IOException {
ois.defaultReadObject();
Runtime.getRuntime().exec(command);
}
}
Toy Example
99
10
Apache Commons Collections Gadget
11
Credits:
Chris Frohoff (@frohoff)
Gabriel Lawrence (@gebl)
by Frohoff & Lawrence
WHAT IF THERE IS NO
INTERESTING CODE
REACHED BY MAGIC
METHODS?
12
Proxy to the rescue
13
Class
field1
field2
…
method1
method2
Interface
method1
method2
Invocation
Handler
Custom code
method2
Proxy
Exploiting InvocationHandler (IH) Gadgets
• Attacker steps upon serialization:
– Attacker controls member fields of IH gadget, which has dangerous code
– IH (as part of Dynamic Proxy) gets serialized by attacker as field on which an
innocuous method is called from "magic method" (of class to deserialize)

• Application steps upon deserialization:
– "Magic Method" of "Trigger Gadget" calls innocuous method on an attacker
controlled field
– This call is intercepted by proxy (set by attacker as this field) and dispatched to IH

• Other IH-like types exist aside from java.lang.reflect.InvocationHandler
– javassist.util.proxy.MethodHandler
– org.jboss.weld.bean.proxy.MethodHandler
14
}no requirement to implement interface
public class TriggerGadget implements Serializable {
private Comparator comp;
…
public final Object readObject(ObjectInputStream ois) throws Exception {
ois.defaultReadObject();
comp.compare("foo", "bar");
}
}
Toy Example: Trigger Gadget
15
Attacker controls this field, so it can set it
to anything implementing
java.util.Comparator … anything, even a
Proxy
Proxy will intercept call to
“compare()” and dispatch it
to its Invocation Handler
15
public class DangerousHandler implements Serializable, InvocationHandler {
private String command;
…
public Object invoke(Object proxy, Method method, Object[] args) {
Runtime.getRuntime().exec(command);
}
}
Toy Example: Dangerous IH
16
Payload execution
16
New RCE gadget in BeanShell (CVE-2016-2510)
• bsh.XThis$Handler
• Serializable
• InvocationHandler
• Upon function interception custom BeanShell code
will be called
• Almost any Java code can be included in the
payload
• In order to invoke the payload a trigger gadget is
needed to dispatch the execution to the
InvocationHandler invoke method
17
New RCE gadget in BeanShell (CVE-2016-2510)
18
MITIGATION ADVICES
19
Mitigation Advice #1: Remove Gadget
20
Tons of Gadgets
• Spring AOP (by Wouter Coekaerts in 2011)
• First public exploit: (by @pwntester in 2013)
• Commons-fileupload (by Arun Babu Neelicattu in 2013)
• Groovy (by cpnrodzc7 / @frohoff in 2015)
• Commons-Collections (by @frohoff and @gebl in 2015)
• Spring Beans (by @frohoff and @gebl in 2015)
• Serial DoS (by Wouter Coekaerts in 2015)
• SpringTx (by @zerothinking in 2016)
• JDK7 (by @frohoff in 2016)
• Beanutils (by @frohoff in 2016)
• Hibernate, MyFaces, C3P0, net.sf.json, ROME (by M. Bechler in 2016)
• Beanshell, Jython, lots of bypasses (by @pwntester and @cschneider4711 in 2016)
• JDK7 Rhino (by @matthias_kaiser in 2016)
21
Mitigation Advice #1: Remove Gadget
22
Mitigation Advice #2: AdHoc Security Manager
23
InputStream is = request.getInputStream();
// Install Security Manager
System.setSecurityManager(new MyDeserializationSM());
// Deserialize the data
ObjectInputStream ois = new ObjectInputStream(ois);
ois.readObject();
// Uninstall (restore) Security Manager
System.setSecurityManager(null);
Attackers can defer execution:
• finalize() method
• Play with expected types (i.e return valid types for the cast which fire later)
If you can uninstall/restore the SecurityManager or refresh the policy, attackers might be able to do it as well
Attackers can defer execution:
• finalize() method
• Play with expected types (i.e return valid types for the cast which fire later)
If you can uninstall/restore the SecurityManager or refresh the policy, attackers might be able to do it as well
Mitigation Advice #2: AdHoc Security Manager
24
InputStream is = request.getInputStream();
// Install Security Manager
System.setSecurityManager(new MyDeserializationSM());
// Deserialize the data
ObjectInputStream ois = new ObjectInputStream(ois);
ois.readObject();
// Uninstall (restore) Security Manager
System.setSecurityManager(null);
Mitigation Advice #3: Defensive Deserialization
25
class DefensiveObjectInputStream extends ObjectInputStream {
@Override
protected Class<?> resolveClass(ObjectStreamClass cls) throws IOException, ClassNotFoundException {
String className = cls.getName();
if ( /* CHECK CLASS NAME AGAINST ALLOWED/DISALLOWED TYPES */) {
throw new InvalidClassException("Unexpected serialized class", className);
}
return super.resolveClass(cls);
}
}
How did vendors handle this recently?
Vendor / Product Type of Protection
Atlassian Bamboo Removed Usage of Serialization
Apache ActiveMQ LAOIS Whitelist
Apache Batchee LAOIS Blacklist + optional Whitelist
Apache JCS LAOIS Blacklist + optional Whitelist
Apache openjpa LAOIS Blacklist + optional Whitelist
Apache Owb LAOIS Blacklist + optional Whitelist
Apache TomEE LAOIS Blacklist + optional Whitelist
********** (still to be fixed) LAOIS Blacklist
26
Bypassing Blacklists Like a Pro ;-)
27
Bypassing LookAhead Blacklists
• New gadget type to bypass ad-hoc look-ahead ObjectInputStream blacklist protections:

• During deserialization of the object graph, a new immaculate unprotected
ObjectInputStream will be instantiated
• Attacker can provide any arbitrary bytes for unsafe deserialization
• Bypass does not work for cases where ObjectInputStream is instrumented
28
public class NestedProblems implements Serializable {
private byte[] bytes … ;
…
private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes));
ois.readObject();
}
}
Is this for real or is this just fantasy?
29
Currently we found many bypass gadgets:

JRE: 2
Third Party Libraries:
Apache libraries: 6
Spring libraries: 1
Other popular libraries: 2
SerialKiller: Bypass Gadget Collection:
https://github.com/pwntester/SerialKillerBypassGadgetCollection
Application Servers:
WildFly (JBoss): 2
IBM WebSphere: 15
Oracle WebLogic: 5
Apache TomEE: 5
Apache Tomcat: 2
Oracle GlassFish: 2
Example: Bypass AdHoc SecurityManager and Blacklists
javax.media.jai.remote.SerializableRenderedImage	
finalize() > dispose() > closeClient()
30
1 private void closeClient() {
2
3 // Connect to the data server.
4 Socket socket = connectToServer();
5
6 // Get the socket output stream and wrap an object
7 // output stream around it.
8 OutputStream out = null;
9 ObjectOutputStream objectOut = null;
10 ObjectInputStream objectIn = null;
11 try {
12 out = socket.getOutputStream();
13 objectOut = new ObjectOutputStream(out);
14 objectIn = new ObjectInputStream(socket.getInputStream());
15 } catch (IOException e) { ... }
16 objectIn.readObject();
Attacking Whitelists: DOS attacks
• SerialDOS by Wouter Coekaerts
• HashSet Billion-Laughs Style

• jInfinity by Arshan Dabirsiaghi
• Size-uninitialized StringBuilder may be abused by huge strings to allocate a large amount of
growing character arrays

• OIS-DOS by Tomáš Polešovský
• Heap overflow when deserializing specially crafted nested ArrayLists, HashMaps or Object arrays
• Hashtable collision
• Uses an Integer overflow to force underlying array to be length 1 and so creating collisions
when adding items with same hashCode
• HashMap collision
• Number of buckets is directly controllable by attacker
• Oracle response: Won’t fix: Serialization should only be used in trusted environments
31
Mitigation Advice #3: Defensive Deserialization
32
class DefensiveObjectInputStream extends ObjectInputStream {
@Override
protected Class<?> resolveClass(ObjectStreamClass cls) throws IOException, ClassNotFoundException {
String className = cls.getName();
if ( /* CHECK CLASS NAME AGAINST ALLOWED/DISALLOWED TYPES */) {
throw new InvalidClassException("Unexpected serialized class", className);
}
return super.resolveClass(cls);
}
}
"GOLDEN GADGETS"
Pure	JRE	Gadgets	
33
AnnotationInvocationHandler Gadget
• “More serialization hacks with AnnotationInvocationHandler”
• 9 Nov 2015 by Wouter Coekaerts (@WouterCoekaerts)
• http://wouter.coekaerts.be/2015/annotationinvocationhandler
• AnnotationInvocationHandler.equalsImpl()
• “When we call equals on an annotation and give it an object
implementing the same interface but not using
AnnotationInvocationHandler, then it goes through all the
methods on the interface and calls them on that object”
34
by Coekaerts
JRE 7u21 Gadget
• 18 Dec 2015 By Chris Frohoff (@frohoff)
• https://gist.github.com/frohoff/24af7913611f8406eaf3
• LinkedHashSet
• readObject() recover items from stream and call
HashMap.put()
• checks key’s hash code and if it already contains
an item with same hash code, calls equals()
35
by Frohoff
JRE 7u21 Gadget
36
HashMap
PayloadObj
a6f7b19c
a6f7b19c
Proxy (PayloadType)
AnnotationInvocationHandler
“f5a5a608” PayloadObjmemberValues
by Frohoff
JRE 7u25 Fix
37
Catch the exception
• Back to Wouter post on AnnotationInvocationHandler tricks …
• Modify the serialized stream and inject an object that catches the
exception. Eg:
• java.beans.beancontext.BeanContextSupport
38
by Coekaerts
New JRE 8u20 Gadget
39
Chris Frohoff Gadget
Wouter’s Technique
Time :)
New JRE 8u20 Gadget
https://gist.github.com/pwntester/ab70e88821b4a6633c06
40
~200 lines of payload
construction code
WHAT ABOUT OTHER
LANGUAGES ON THE JVM?
41
Scala & Groovy
42
import java.io._
object SerializationDemo extends App {
val ois = new ObjectInputStream(new FileInputStream(“exploit.ser"))
val o = ois.readObject()
ois.close()
}
import java.io.*
File exploit = new File('exploit.ser')
try {
def is = exploit.newObjectInputStream(this.class.classLoader)
is.eachObject { println it }
} catch (e) { throw new Exception(e) } finally { is?.close() }
Source	code:	https://github.com/pwntester/JVMDeserialization
WHAT TO DO
THEN?
43
How to Harden Your Applications?
DO NOT DESERIALIZE UNTRUSTED DATA!!
• When architecture permits it:
– Use other formats instead of serialized objects: JSON, XML, etc.
• But be aware of XML-based deserialization attacks via XStream, XmlDecoder, etc.
As second-best option:
– Use defensive deserialization with look-ahead OIS with a strict whitelist
• Don’t rely on gadget-blacklisting alone!
• You can build the whitelist with OpenSource agent SWAT 

( Serial Whitelist Application Trainer: https://github.com/cschneider4711/SWAT )
• Prefer an agent-based instrumenting of ObjectInputStream towards LAOIS
• Scan your own whitelisted code for potential gadgets
• Still be aware of DoS scenarios
44
FINDING VULNERABILITIES
& GADGETS IN THE CODE
SAST	Tips
45
Finding deserialization endpoints
• Check your endpoints for those accepting (untrusted) serialized data
• Find calls to:
• ObjectInputStream.readObject()
• ObjectInputStream.readUnshared()
• Where InputStream is attacker-controlled. For example:
• May happen in library code. Eg: JMS, JMX, RMI, Queues, Brokers, Spring
HTTPInvokers, etc …
46
InputStream is = request.getInputStream();
ObjectInputStream ois = new ObjectInputStream(ois);
ois.readObject();
Finding gadgets in a Haystack
• Check your code for potential gadgets, which could be used in deserialization
• "Gadget Space" is too big. Typical app-server based deployments have hundreds of JARs
• SAST tools such as HPE Security Fortify SCA might help
47
Look for interesting method calls …
java.lang.reflect.Method.invoke()
java.io.File()
java.io.ObjectInputStream()
java.net.URLClassLoader()
java.net.Socket()
java.net.URL()
javax.naming.Context.lookup()
…
… reached by:
java.io.Externalizable.readExternal()
java.io.Serializable.readObject()
java.io.Serializable.readObjectNoData()
java.io.Serializable.readResolve()
java.io.ObjectInputValidation.validateObject()
java.lang.reflect.InvocationHandler.invoke()
java.lang.Object.finalize()
Serializable InvocationHandlers …
WHAT TO CHECK
DURING PENTESTS?
DAST	Tips
48
Passive deserialization endpoint detection
• Find requests (or any network traffic) carrying serialized Java objects:
• Easy to spot due to magic bytes at the beginning: 0xAC 0xED …
• Some web-apps might use Base64 to store serialized data 

in Cookies, etc.: rO0AB …
• Be aware that compression could’ve been applied before Base64
• 0x1F8B 0x0800 …
• H4sIA …
• Tools
• Use professional scanners for enterprise-level scans
• Use Free ZAP/Burp Plugins such as SuperSerial to passively scan for Java serialization
• Use WireShark for network traffic
• If allowed to instrument the app use runtime agents such as SWAT to find out if anything
gets deserialized
49
Q & A / Thank You !
Chris9an	Schneider
@cschneider4711	
mail@ChrisHan-Schneider.net	
Alvaro	Muñoz
@pwntester	
alvaro.munoz@hpe.com	
FAQ:	

https://Christian-Schneider.net/JavaDeserializationSecurityFAQ.html	
Whitepaper:	

https://community.hpe.com/t5/Security-Research/The-perils-of-Java-
deserialization/ba-p/6838995
… and remember:

DO NOT DESERIALIZE

UNTRUSTED DATA!!

Contenu connexe

Tendances

ORM2Pwn: Exploiting injections in Hibernate ORM
ORM2Pwn: Exploiting injections in Hibernate ORMORM2Pwn: Exploiting injections in Hibernate ORM
ORM2Pwn: Exploiting injections in Hibernate ORMMikhail Egorov
 
Neat tricks to bypass CSRF-protection
Neat tricks to bypass CSRF-protectionNeat tricks to bypass CSRF-protection
Neat tricks to bypass CSRF-protectionMikhail Egorov
 
Hacking Adobe Experience Manager sites
Hacking Adobe Experience Manager sitesHacking Adobe Experience Manager sites
Hacking Adobe Experience Manager sitesMikhail Egorov
 
Java Deserialization Vulnerabilities - The Forgotten Bug Class (DeepSec Edition)
Java Deserialization Vulnerabilities - The Forgotten Bug Class (DeepSec Edition)Java Deserialization Vulnerabilities - The Forgotten Bug Class (DeepSec Edition)
Java Deserialization Vulnerabilities - The Forgotten Bug Class (DeepSec Edition)CODE WHITE GmbH
 
AEM hacker - approaching Adobe Experience Manager webapps in bug bounty programs
AEM hacker - approaching Adobe Experience Manager webapps in bug bounty programsAEM hacker - approaching Adobe Experience Manager webapps in bug bounty programs
AEM hacker - approaching Adobe Experience Manager webapps in bug bounty programsMikhail Egorov
 
What should a hacker know about WebDav?
What should a hacker know about WebDav?What should a hacker know about WebDav?
What should a hacker know about WebDav?Mikhail Egorov
 
PHP unserialization vulnerabilities: What are we missing?
PHP unserialization vulnerabilities: What are we missing?PHP unserialization vulnerabilities: What are we missing?
PHP unserialization vulnerabilities: What are we missing?Sam Thomas
 
A Hacker's perspective on AEM applications security
A Hacker's perspective on AEM applications securityA Hacker's perspective on AEM applications security
A Hacker's perspective on AEM applications securityMikhail Egorov
 
Hacking Oracle From Web Apps 1 9
Hacking Oracle From Web Apps 1 9Hacking Oracle From Web Apps 1 9
Hacking Oracle From Web Apps 1 9sumsid1234
 
An Abusive Relationship with AngularJS
An Abusive Relationship with AngularJSAn Abusive Relationship with AngularJS
An Abusive Relationship with AngularJSMario Heiderich
 
Securing AEM webapps by hacking them
Securing AEM webapps by hacking themSecuring AEM webapps by hacking them
Securing AEM webapps by hacking themMikhail Egorov
 
Pentesting react native application for fun and profit - Abdullah
Pentesting react native application for fun and profit - AbdullahPentesting react native application for fun and profit - Abdullah
Pentesting react native application for fun and profit - Abdullahidsecconf
 
Insecure Java Deserialization
Insecure Java DeserializationInsecure Java Deserialization
Insecure Java DeserializationShiv Sahni
 
XXE: How to become a Jedi
XXE: How to become a JediXXE: How to become a Jedi
XXE: How to become a JediYaroslav Babin
 
Asfws 2014 slides why .net needs ma-cs and other serial(-ization) tales_v2.0
Asfws 2014 slides why .net needs ma-cs and other serial(-ization) tales_v2.0Asfws 2014 slides why .net needs ma-cs and other serial(-ization) tales_v2.0
Asfws 2014 slides why .net needs ma-cs and other serial(-ization) tales_v2.0Cyber Security Alliance
 
Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)
Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)
Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)CODE WHITE GmbH
 
Practical Application of the API Security Top Ten: A Tester's Perspective
Practical Application of the API Security Top Ten: A Tester's PerspectivePractical Application of the API Security Top Ten: A Tester's Perspective
Practical Application of the API Security Top Ten: A Tester's PerspectiveRajniHatti
 
Java Serialization Deep Dive
Java Serialization Deep DiveJava Serialization Deep Dive
Java Serialization Deep DiveMartijn Dashorst
 

Tendances (20)

Fixing the Java Serialization Mess
Fixing the Java Serialization Mess Fixing the Java Serialization Mess
Fixing the Java Serialization Mess
 
ORM2Pwn: Exploiting injections in Hibernate ORM
ORM2Pwn: Exploiting injections in Hibernate ORMORM2Pwn: Exploiting injections in Hibernate ORM
ORM2Pwn: Exploiting injections in Hibernate ORM
 
Neat tricks to bypass CSRF-protection
Neat tricks to bypass CSRF-protectionNeat tricks to bypass CSRF-protection
Neat tricks to bypass CSRF-protection
 
Hacking Adobe Experience Manager sites
Hacking Adobe Experience Manager sitesHacking Adobe Experience Manager sites
Hacking Adobe Experience Manager sites
 
Java Deserialization Vulnerabilities - The Forgotten Bug Class (DeepSec Edition)
Java Deserialization Vulnerabilities - The Forgotten Bug Class (DeepSec Edition)Java Deserialization Vulnerabilities - The Forgotten Bug Class (DeepSec Edition)
Java Deserialization Vulnerabilities - The Forgotten Bug Class (DeepSec Edition)
 
AEM hacker - approaching Adobe Experience Manager webapps in bug bounty programs
AEM hacker - approaching Adobe Experience Manager webapps in bug bounty programsAEM hacker - approaching Adobe Experience Manager webapps in bug bounty programs
AEM hacker - approaching Adobe Experience Manager webapps in bug bounty programs
 
What should a hacker know about WebDav?
What should a hacker know about WebDav?What should a hacker know about WebDav?
What should a hacker know about WebDav?
 
PHP unserialization vulnerabilities: What are we missing?
PHP unserialization vulnerabilities: What are we missing?PHP unserialization vulnerabilities: What are we missing?
PHP unserialization vulnerabilities: What are we missing?
 
A Hacker's perspective on AEM applications security
A Hacker's perspective on AEM applications securityA Hacker's perspective on AEM applications security
A Hacker's perspective on AEM applications security
 
Hacking Oracle From Web Apps 1 9
Hacking Oracle From Web Apps 1 9Hacking Oracle From Web Apps 1 9
Hacking Oracle From Web Apps 1 9
 
An Abusive Relationship with AngularJS
An Abusive Relationship with AngularJSAn Abusive Relationship with AngularJS
An Abusive Relationship with AngularJS
 
Securing AEM webapps by hacking them
Securing AEM webapps by hacking themSecuring AEM webapps by hacking them
Securing AEM webapps by hacking them
 
Pentesting react native application for fun and profit - Abdullah
Pentesting react native application for fun and profit - AbdullahPentesting react native application for fun and profit - Abdullah
Pentesting react native application for fun and profit - Abdullah
 
Insecure Java Deserialization
Insecure Java DeserializationInsecure Java Deserialization
Insecure Java Deserialization
 
XXE: How to become a Jedi
XXE: How to become a JediXXE: How to become a Jedi
XXE: How to become a Jedi
 
Asfws 2014 slides why .net needs ma-cs and other serial(-ization) tales_v2.0
Asfws 2014 slides why .net needs ma-cs and other serial(-ization) tales_v2.0Asfws 2014 slides why .net needs ma-cs and other serial(-ization) tales_v2.0
Asfws 2014 slides why .net needs ma-cs and other serial(-ization) tales_v2.0
 
Js: master prototypes
Js: master prototypesJs: master prototypes
Js: master prototypes
 
Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)
Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)
Java Deserialization Vulnerabilities - The Forgotten Bug Class (RuhrSec Edition)
 
Practical Application of the API Security Top Ten: A Tester's Perspective
Practical Application of the API Security Top Ten: A Tester's PerspectivePractical Application of the API Security Top Ten: A Tester's Perspective
Practical Application of the API Security Top Ten: A Tester's Perspective
 
Java Serialization Deep Dive
Java Serialization Deep DiveJava Serialization Deep Dive
Java Serialization Deep Dive
 

Similaire à Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016

Safe Wrappers and Sane Policies for Self Protecting JavaScript
Safe Wrappers and Sane Policies for Self Protecting JavaScript�Safe Wrappers and Sane Policies for Self Protecting JavaScript�
Safe Wrappers and Sane Policies for Self Protecting JavaScriptPhú Phùng
 
Automated Discovery of Deserialization Gadget Chains
Automated Discovery of Deserialization Gadget ChainsAutomated Discovery of Deserialization Gadget Chains
Automated Discovery of Deserialization Gadget ChainsPriyanka Aash
 
Automated Discovery of Deserialization Gadget Chains
Automated Discovery of Deserialization Gadget ChainsAutomated Discovery of Deserialization Gadget Chains
Automated Discovery of Deserialization Gadget ChainsPriyanka Aash
 
Unsafe Deserialization Attacks In Java and A New Approach To Protect The JVM ...
Unsafe Deserialization Attacks In Java and A New Approach To Protect The JVM ...Unsafe Deserialization Attacks In Java and A New Approach To Protect The JVM ...
Unsafe Deserialization Attacks In Java and A New Approach To Protect The JVM ...Apostolos Giannakidis
 
【Unite 2017 Tokyo】ScriptableObjectを使ってプログラマーもアーティストも幸せになろう
【Unite 2017 Tokyo】ScriptableObjectを使ってプログラマーもアーティストも幸せになろう【Unite 2017 Tokyo】ScriptableObjectを使ってプログラマーもアーティストも幸せになろう
【Unite 2017 Tokyo】ScriptableObjectを使ってプログラマーもアーティストも幸せになろうUnity Technologies Japan K.K.
 
Automated Discovery of Deserialization Gadget Chains
 Automated Discovery of Deserialization Gadget Chains Automated Discovery of Deserialization Gadget Chains
Automated Discovery of Deserialization Gadget ChainsPriyanka Aash
 
Java Unit Test and Coverage Introduction
Java Unit Test and Coverage IntroductionJava Unit Test and Coverage Introduction
Java Unit Test and Coverage IntroductionAlex Su
 
Application Frameworks: The new kids on the block
Application Frameworks: The new kids on the blockApplication Frameworks: The new kids on the block
Application Frameworks: The new kids on the blockRichard Lord
 
Современные технологии и инструменты анализа вредоносного ПО
Современные технологии и инструменты анализа вредоносного ПОСовременные технологии и инструменты анализа вредоносного ПО
Современные технологии и инструменты анализа вредоносного ПОPositive Hack Days
 
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...Ivan Piskunov
 
Architecting for Microservices Part 2
Architecting for Microservices Part 2Architecting for Microservices Part 2
Architecting for Microservices Part 2Elana Krasner
 
JDK Tools For Performance Diagnostics
JDK Tools For Performance DiagnosticsJDK Tools For Performance Diagnostics
JDK Tools For Performance DiagnosticsBaruch Sadogursky
 
Mobile Developers Talks: Delve Mobile
Mobile Developers Talks: Delve MobileMobile Developers Talks: Delve Mobile
Mobile Developers Talks: Delve MobileKonstantin Loginov
 
Static code analysis: what? how? why?
Static code analysis: what? how? why?Static code analysis: what? how? why?
Static code analysis: what? how? why?Andrey Karpov
 
Better Code through Lint and Checkstyle
Better Code through Lint and CheckstyleBetter Code through Lint and Checkstyle
Better Code through Lint and CheckstyleMarc Prengemann
 
Dynamic data race detection in concurrent Java programs
Dynamic data race detection in concurrent Java programsDynamic data race detection in concurrent Java programs
Dynamic data race detection in concurrent Java programsDevexperts
 
Android UI Development: Tips, Tricks, and Techniques
Android UI Development: Tips, Tricks, and TechniquesAndroid UI Development: Tips, Tricks, and Techniques
Android UI Development: Tips, Tricks, and TechniquesEdgar Gonzalez
 
Android UI Tips, Tricks and Techniques
Android UI Tips, Tricks and TechniquesAndroid UI Tips, Tricks and Techniques
Android UI Tips, Tricks and TechniquesMarakana Inc.
 
More topics on Java
More topics on JavaMore topics on Java
More topics on JavaAhmed Misbah
 

Similaire à Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016 (20)

Safe Wrappers and Sane Policies for Self Protecting JavaScript
Safe Wrappers and Sane Policies for Self Protecting JavaScript�Safe Wrappers and Sane Policies for Self Protecting JavaScript�
Safe Wrappers and Sane Policies for Self Protecting JavaScript
 
Automated Discovery of Deserialization Gadget Chains
Automated Discovery of Deserialization Gadget ChainsAutomated Discovery of Deserialization Gadget Chains
Automated Discovery of Deserialization Gadget Chains
 
Automated Discovery of Deserialization Gadget Chains
Automated Discovery of Deserialization Gadget ChainsAutomated Discovery of Deserialization Gadget Chains
Automated Discovery of Deserialization Gadget Chains
 
Unsafe Deserialization Attacks In Java and A New Approach To Protect The JVM ...
Unsafe Deserialization Attacks In Java and A New Approach To Protect The JVM ...Unsafe Deserialization Attacks In Java and A New Approach To Protect The JVM ...
Unsafe Deserialization Attacks In Java and A New Approach To Protect The JVM ...
 
【Unite 2017 Tokyo】ScriptableObjectを使ってプログラマーもアーティストも幸せになろう
【Unite 2017 Tokyo】ScriptableObjectを使ってプログラマーもアーティストも幸せになろう【Unite 2017 Tokyo】ScriptableObjectを使ってプログラマーもアーティストも幸せになろう
【Unite 2017 Tokyo】ScriptableObjectを使ってプログラマーもアーティストも幸せになろう
 
Automated Discovery of Deserialization Gadget Chains
 Automated Discovery of Deserialization Gadget Chains Automated Discovery of Deserialization Gadget Chains
Automated Discovery of Deserialization Gadget Chains
 
Java Unit Test and Coverage Introduction
Java Unit Test and Coverage IntroductionJava Unit Test and Coverage Introduction
Java Unit Test and Coverage Introduction
 
Application Frameworks: The new kids on the block
Application Frameworks: The new kids on the blockApplication Frameworks: The new kids on the block
Application Frameworks: The new kids on the block
 
Современные технологии и инструменты анализа вредоносного ПО
Современные технологии и инструменты анализа вредоносного ПОСовременные технологии и инструменты анализа вредоносного ПО
Современные технологии и инструменты анализа вредоносного ПО
 
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...
Современные технологии и инструменты анализа вредоносного ПО_PHDays_2017_Pisk...
 
Architecting for Microservices Part 2
Architecting for Microservices Part 2Architecting for Microservices Part 2
Architecting for Microservices Part 2
 
JDK Tools For Performance Diagnostics
JDK Tools For Performance DiagnosticsJDK Tools For Performance Diagnostics
JDK Tools For Performance Diagnostics
 
Mobile Developers Talks: Delve Mobile
Mobile Developers Talks: Delve MobileMobile Developers Talks: Delve Mobile
Mobile Developers Talks: Delve Mobile
 
Static code analysis: what? how? why?
Static code analysis: what? how? why?Static code analysis: what? how? why?
Static code analysis: what? how? why?
 
Building XWiki
Building XWikiBuilding XWiki
Building XWiki
 
Better Code through Lint and Checkstyle
Better Code through Lint and CheckstyleBetter Code through Lint and Checkstyle
Better Code through Lint and Checkstyle
 
Dynamic data race detection in concurrent Java programs
Dynamic data race detection in concurrent Java programsDynamic data race detection in concurrent Java programs
Dynamic data race detection in concurrent Java programs
 
Android UI Development: Tips, Tricks, and Techniques
Android UI Development: Tips, Tricks, and TechniquesAndroid UI Development: Tips, Tricks, and Techniques
Android UI Development: Tips, Tricks, and Techniques
 
Android UI Tips, Tricks and Techniques
Android UI Tips, Tricks and TechniquesAndroid UI Tips, Tricks and Techniques
Android UI Tips, Tricks and Techniques
 
More topics on Java
More topics on JavaMore topics on Java
More topics on Java
 

Dernier

OpenChain AI Study Group - Europe and Asia Recap - 2024-04-11 - Full Recording
OpenChain AI Study Group - Europe and Asia Recap - 2024-04-11 - Full RecordingOpenChain AI Study Group - Europe and Asia Recap - 2024-04-11 - Full Recording
OpenChain AI Study Group - Europe and Asia Recap - 2024-04-11 - Full RecordingShane Coughlan
 
Machine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their EngineeringMachine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their EngineeringHironori Washizaki
 
How to submit a standout Adobe Champion Application
How to submit a standout Adobe Champion ApplicationHow to submit a standout Adobe Champion Application
How to submit a standout Adobe Champion ApplicationBradBedford3
 
SoftTeco - Software Development Company Profile
SoftTeco - Software Development Company ProfileSoftTeco - Software Development Company Profile
SoftTeco - Software Development Company Profileakrivarotava
 
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...Angel Borroy López
 
Introduction to Firebase Workshop Slides
Introduction to Firebase Workshop SlidesIntroduction to Firebase Workshop Slides
Introduction to Firebase Workshop Slidesvaideheekore1
 
Understanding Flamingo - DeepMind's VLM Architecture
Understanding Flamingo - DeepMind's VLM ArchitectureUnderstanding Flamingo - DeepMind's VLM Architecture
Understanding Flamingo - DeepMind's VLM Architecturerahul_net
 
2024 DevNexus Patterns for Resiliency: Shuffle shards
2024 DevNexus Patterns for Resiliency: Shuffle shards2024 DevNexus Patterns for Resiliency: Shuffle shards
2024 DevNexus Patterns for Resiliency: Shuffle shardsChristopher Curtin
 
The Role of IoT and Sensor Technology in Cargo Cloud Solutions.pptx
The Role of IoT and Sensor Technology in Cargo Cloud Solutions.pptxThe Role of IoT and Sensor Technology in Cargo Cloud Solutions.pptx
The Role of IoT and Sensor Technology in Cargo Cloud Solutions.pptxRTS corp
 
Powering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data StreamsPowering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data StreamsSafe Software
 
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...Cizo Technology Services
 
Salesforce Implementation Services PPT By ABSYZ
Salesforce Implementation Services PPT By ABSYZSalesforce Implementation Services PPT By ABSYZ
Salesforce Implementation Services PPT By ABSYZABSYZ Inc
 
Simplifying Microservices & Apps - The art of effortless development - Meetup...
Simplifying Microservices & Apps - The art of effortless development - Meetup...Simplifying Microservices & Apps - The art of effortless development - Meetup...
Simplifying Microservices & Apps - The art of effortless development - Meetup...Rob Geurden
 
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdf
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdfEnhancing Supply Chain Visibility with Cargo Cloud Solutions.pdf
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdfRTS corp
 
Patterns for automating API delivery. API conference
Patterns for automating API delivery. API conferencePatterns for automating API delivery. API conference
Patterns for automating API delivery. API conferencessuser9e7c64
 
SAM Training Session - How to use EXCEL ?
SAM Training Session - How to use EXCEL ?SAM Training Session - How to use EXCEL ?
SAM Training Session - How to use EXCEL ?Alexandre Beguel
 
What’s New in VictoriaMetrics: Q1 2024 Updates
What’s New in VictoriaMetrics: Q1 2024 UpdatesWhat’s New in VictoriaMetrics: Q1 2024 Updates
What’s New in VictoriaMetrics: Q1 2024 UpdatesVictoriaMetrics
 
Best Angular 17 Classroom & Online training - Naresh IT
Best Angular 17 Classroom & Online training - Naresh ITBest Angular 17 Classroom & Online training - Naresh IT
Best Angular 17 Classroom & Online training - Naresh ITmanoharjgpsolutions
 
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdf
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdfExploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdf
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdfkalichargn70th171
 
SpotFlow: Tracking Method Calls and States at Runtime
SpotFlow: Tracking Method Calls and States at RuntimeSpotFlow: Tracking Method Calls and States at Runtime
SpotFlow: Tracking Method Calls and States at Runtimeandrehoraa
 

Dernier (20)

OpenChain AI Study Group - Europe and Asia Recap - 2024-04-11 - Full Recording
OpenChain AI Study Group - Europe and Asia Recap - 2024-04-11 - Full RecordingOpenChain AI Study Group - Europe and Asia Recap - 2024-04-11 - Full Recording
OpenChain AI Study Group - Europe and Asia Recap - 2024-04-11 - Full Recording
 
Machine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their EngineeringMachine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their Engineering
 
How to submit a standout Adobe Champion Application
How to submit a standout Adobe Champion ApplicationHow to submit a standout Adobe Champion Application
How to submit a standout Adobe Champion Application
 
SoftTeco - Software Development Company Profile
SoftTeco - Software Development Company ProfileSoftTeco - Software Development Company Profile
SoftTeco - Software Development Company Profile
 
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
 
Introduction to Firebase Workshop Slides
Introduction to Firebase Workshop SlidesIntroduction to Firebase Workshop Slides
Introduction to Firebase Workshop Slides
 
Understanding Flamingo - DeepMind's VLM Architecture
Understanding Flamingo - DeepMind's VLM ArchitectureUnderstanding Flamingo - DeepMind's VLM Architecture
Understanding Flamingo - DeepMind's VLM Architecture
 
2024 DevNexus Patterns for Resiliency: Shuffle shards
2024 DevNexus Patterns for Resiliency: Shuffle shards2024 DevNexus Patterns for Resiliency: Shuffle shards
2024 DevNexus Patterns for Resiliency: Shuffle shards
 
The Role of IoT and Sensor Technology in Cargo Cloud Solutions.pptx
The Role of IoT and Sensor Technology in Cargo Cloud Solutions.pptxThe Role of IoT and Sensor Technology in Cargo Cloud Solutions.pptx
The Role of IoT and Sensor Technology in Cargo Cloud Solutions.pptx
 
Powering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data StreamsPowering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data Streams
 
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...
 
Salesforce Implementation Services PPT By ABSYZ
Salesforce Implementation Services PPT By ABSYZSalesforce Implementation Services PPT By ABSYZ
Salesforce Implementation Services PPT By ABSYZ
 
Simplifying Microservices & Apps - The art of effortless development - Meetup...
Simplifying Microservices & Apps - The art of effortless development - Meetup...Simplifying Microservices & Apps - The art of effortless development - Meetup...
Simplifying Microservices & Apps - The art of effortless development - Meetup...
 
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdf
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdfEnhancing Supply Chain Visibility with Cargo Cloud Solutions.pdf
Enhancing Supply Chain Visibility with Cargo Cloud Solutions.pdf
 
Patterns for automating API delivery. API conference
Patterns for automating API delivery. API conferencePatterns for automating API delivery. API conference
Patterns for automating API delivery. API conference
 
SAM Training Session - How to use EXCEL ?
SAM Training Session - How to use EXCEL ?SAM Training Session - How to use EXCEL ?
SAM Training Session - How to use EXCEL ?
 
What’s New in VictoriaMetrics: Q1 2024 Updates
What’s New in VictoriaMetrics: Q1 2024 UpdatesWhat’s New in VictoriaMetrics: Q1 2024 Updates
What’s New in VictoriaMetrics: Q1 2024 Updates
 
Best Angular 17 Classroom & Online training - Naresh IT
Best Angular 17 Classroom & Online training - Naresh ITBest Angular 17 Classroom & Online training - Naresh IT
Best Angular 17 Classroom & Online training - Naresh IT
 
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdf
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdfExploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdf
Exploring Selenium_Appium Frameworks for Seamless Integration with HeadSpin.pdf
 
SpotFlow: Tracking Method Calls and States at Runtime
SpotFlow: Tracking Method Calls and States at RuntimeSpotFlow: Tracking Method Calls and States at Runtime
SpotFlow: Tracking Method Calls and States at Runtime
 

Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016

  • 1. Alvaro Muñoz, @pwntester Christian Schneider, @cschneider4711 Surviving the Java Serialization Apocalypse JVM
  • 2. Why this talk? • Java deserialization attacks have been known for years – Relatively new gadget in Apache Commons-Collections made the topic available to a broader audience in 2015 • Some inaccurate advice to protect your applications is making the rounds – In this talk we’ll demonstrate the weakness of this advice by … • … showing you new RCE gadgets • … showing you bypasses • We’ll give advice how to spot this vulnerability and its gadgets during … – … code reviews (i.e. showing you what to look for) – … pentests (i.e. how to generically test for such issues) 2
  • 3. Quick Poll 3 InputStream is = request.getInputStream(); ObjectInputStream ois = new ObjectInputStream(ois); ois.readObject(); Deserializing user-controlled data will get you compromised in the worst case … ... and probably will crash your JVM in the best. Spoiler Alert
  • 4. JAVA (DE)SERIALIZATION 101 • Taking a snapshot of an object graph as a byte stream that can be used to reconstruct the object graph to its original state • Only object data is serialized, not the code • The code sits on the Classpath of the deserializing end 4 Object Graph Object Graph ACED 0005 …
  • 5. Attack Surface • Usages of Java serialization in protocols/formats/products: – RMI (Remote Method Invocation) – JMX (Java Management Extension) – JMS (Java Messaging System) – Spring Service Invokers • HTTP, JMS, RMI, etc. – Android – AMF (Action Message Format) – JSF ViewState – WebLogic T3 – … 5
  • 6. Java Deserialization in a Nutshell 6 Serializable Class 6. Restore object member fields • readObject(ObjectInputStream) • readObjectNoData() 7. Eventually replace restored object • readResolve() 8. Optionally validate object • validateObject() 9. Cast deserialized object to expected type 10.Use deserialized object ObjectInputStream Application Code Garbage Collector 11.Call finalize() on GC 1. Get bytes 2. Initialize ObjectInputStream 3. Read object from stream • ois.readObject() 4. Resolve classes of stream resolveClass() 5. Deserialize objects
  • 7. ABUSING “MAGIC METHODS” • Abusing "magic methods" of gadgets which have dangerous code: • Attacker controls member fields / fields’ values of serialized object • Upon deserialization .readObject() / .readResolve() is invoked • Implementation of this method in gadget class uses attacker-controlled fields • Aside from the classic ones also lesser-known "magic methods" help: • .validateObject() as part of validation (which does not prevent attacks) • .readObjectNoData() upon deserialization conflicts • .finalize() as part of GC (even after errors) • Works also for Externalizable’s .readExternal() 7
  • 8. Triggering Execution via "Magic Methods" 8 Serializable Class 6. Restore object member fields • readObject(ObjectInputStream) • readObjectNoData() 7. Eventually replace restored object • readResolve() 8. Optionally validate object • validateObject() 9. Cast deserialized object to expected type 10.Use deserialized object ObjectInputStream Application Code Garbage Collector 11.Call finalize() on GC 1. Get bytes 2. Initialize ObjectInputStream 3. Read object from stream • ois.readObject() 4. Resolve classes of stream resolveClass() 5. Deserialize objects
  • 9. public class DangerousToy implements Serializable { private String command; … public final Object readObject(ObjectInputStream ois) throws OptionalDataException, ClassNotFoundException, IOException { ois.defaultReadObject(); Runtime.getRuntime().exec(command); } } Toy Example 99
  • 10. 10
  • 11. Apache Commons Collections Gadget 11 Credits: Chris Frohoff (@frohoff) Gabriel Lawrence (@gebl) by Frohoff & Lawrence
  • 12. WHAT IF THERE IS NO INTERESTING CODE REACHED BY MAGIC METHODS? 12
  • 13. Proxy to the rescue 13 Class field1 field2 … method1 method2 Interface method1 method2 Invocation Handler Custom code method2 Proxy
  • 14. Exploiting InvocationHandler (IH) Gadgets • Attacker steps upon serialization: – Attacker controls member fields of IH gadget, which has dangerous code – IH (as part of Dynamic Proxy) gets serialized by attacker as field on which an innocuous method is called from "magic method" (of class to deserialize)
 • Application steps upon deserialization: – "Magic Method" of "Trigger Gadget" calls innocuous method on an attacker controlled field – This call is intercepted by proxy (set by attacker as this field) and dispatched to IH
 • Other IH-like types exist aside from java.lang.reflect.InvocationHandler – javassist.util.proxy.MethodHandler – org.jboss.weld.bean.proxy.MethodHandler 14 }no requirement to implement interface
  • 15. public class TriggerGadget implements Serializable { private Comparator comp; … public final Object readObject(ObjectInputStream ois) throws Exception { ois.defaultReadObject(); comp.compare("foo", "bar"); } } Toy Example: Trigger Gadget 15 Attacker controls this field, so it can set it to anything implementing java.util.Comparator … anything, even a Proxy Proxy will intercept call to “compare()” and dispatch it to its Invocation Handler 15
  • 16. public class DangerousHandler implements Serializable, InvocationHandler { private String command; … public Object invoke(Object proxy, Method method, Object[] args) { Runtime.getRuntime().exec(command); } } Toy Example: Dangerous IH 16 Payload execution 16
  • 17. New RCE gadget in BeanShell (CVE-2016-2510) • bsh.XThis$Handler • Serializable • InvocationHandler • Upon function interception custom BeanShell code will be called • Almost any Java code can be included in the payload • In order to invoke the payload a trigger gadget is needed to dispatch the execution to the InvocationHandler invoke method 17
  • 18. New RCE gadget in BeanShell (CVE-2016-2510) 18
  • 20. Mitigation Advice #1: Remove Gadget 20
  • 21. Tons of Gadgets • Spring AOP (by Wouter Coekaerts in 2011) • First public exploit: (by @pwntester in 2013) • Commons-fileupload (by Arun Babu Neelicattu in 2013) • Groovy (by cpnrodzc7 / @frohoff in 2015) • Commons-Collections (by @frohoff and @gebl in 2015) • Spring Beans (by @frohoff and @gebl in 2015) • Serial DoS (by Wouter Coekaerts in 2015) • SpringTx (by @zerothinking in 2016) • JDK7 (by @frohoff in 2016) • Beanutils (by @frohoff in 2016) • Hibernate, MyFaces, C3P0, net.sf.json, ROME (by M. Bechler in 2016) • Beanshell, Jython, lots of bypasses (by @pwntester and @cschneider4711 in 2016) • JDK7 Rhino (by @matthias_kaiser in 2016) 21
  • 22. Mitigation Advice #1: Remove Gadget 22
  • 23. Mitigation Advice #2: AdHoc Security Manager 23 InputStream is = request.getInputStream(); // Install Security Manager System.setSecurityManager(new MyDeserializationSM()); // Deserialize the data ObjectInputStream ois = new ObjectInputStream(ois); ois.readObject(); // Uninstall (restore) Security Manager System.setSecurityManager(null); Attackers can defer execution: • finalize() method • Play with expected types (i.e return valid types for the cast which fire later) If you can uninstall/restore the SecurityManager or refresh the policy, attackers might be able to do it as well
  • 24. Attackers can defer execution: • finalize() method • Play with expected types (i.e return valid types for the cast which fire later) If you can uninstall/restore the SecurityManager or refresh the policy, attackers might be able to do it as well Mitigation Advice #2: AdHoc Security Manager 24 InputStream is = request.getInputStream(); // Install Security Manager System.setSecurityManager(new MyDeserializationSM()); // Deserialize the data ObjectInputStream ois = new ObjectInputStream(ois); ois.readObject(); // Uninstall (restore) Security Manager System.setSecurityManager(null);
  • 25. Mitigation Advice #3: Defensive Deserialization 25 class DefensiveObjectInputStream extends ObjectInputStream { @Override protected Class<?> resolveClass(ObjectStreamClass cls) throws IOException, ClassNotFoundException { String className = cls.getName(); if ( /* CHECK CLASS NAME AGAINST ALLOWED/DISALLOWED TYPES */) { throw new InvalidClassException("Unexpected serialized class", className); } return super.resolveClass(cls); } }
  • 26. How did vendors handle this recently? Vendor / Product Type of Protection Atlassian Bamboo Removed Usage of Serialization Apache ActiveMQ LAOIS Whitelist Apache Batchee LAOIS Blacklist + optional Whitelist Apache JCS LAOIS Blacklist + optional Whitelist Apache openjpa LAOIS Blacklist + optional Whitelist Apache Owb LAOIS Blacklist + optional Whitelist Apache TomEE LAOIS Blacklist + optional Whitelist ********** (still to be fixed) LAOIS Blacklist 26
  • 28. Bypassing LookAhead Blacklists • New gadget type to bypass ad-hoc look-ahead ObjectInputStream blacklist protections:
 • During deserialization of the object graph, a new immaculate unprotected ObjectInputStream will be instantiated • Attacker can provide any arbitrary bytes for unsafe deserialization • Bypass does not work for cases where ObjectInputStream is instrumented 28 public class NestedProblems implements Serializable { private byte[] bytes … ; … private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException { ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes)); ois.readObject(); } }
  • 29. Is this for real or is this just fantasy? 29 Currently we found many bypass gadgets:
 JRE: 2 Third Party Libraries: Apache libraries: 6 Spring libraries: 1 Other popular libraries: 2 SerialKiller: Bypass Gadget Collection: https://github.com/pwntester/SerialKillerBypassGadgetCollection Application Servers: WildFly (JBoss): 2 IBM WebSphere: 15 Oracle WebLogic: 5 Apache TomEE: 5 Apache Tomcat: 2 Oracle GlassFish: 2
  • 30. Example: Bypass AdHoc SecurityManager and Blacklists javax.media.jai.remote.SerializableRenderedImage finalize() > dispose() > closeClient() 30 1 private void closeClient() { 2 3 // Connect to the data server. 4 Socket socket = connectToServer(); 5 6 // Get the socket output stream and wrap an object 7 // output stream around it. 8 OutputStream out = null; 9 ObjectOutputStream objectOut = null; 10 ObjectInputStream objectIn = null; 11 try { 12 out = socket.getOutputStream(); 13 objectOut = new ObjectOutputStream(out); 14 objectIn = new ObjectInputStream(socket.getInputStream()); 15 } catch (IOException e) { ... } 16 objectIn.readObject();
  • 31. Attacking Whitelists: DOS attacks • SerialDOS by Wouter Coekaerts • HashSet Billion-Laughs Style
 • jInfinity by Arshan Dabirsiaghi • Size-uninitialized StringBuilder may be abused by huge strings to allocate a large amount of growing character arrays
 • OIS-DOS by Tomáš Polešovský • Heap overflow when deserializing specially crafted nested ArrayLists, HashMaps or Object arrays • Hashtable collision • Uses an Integer overflow to force underlying array to be length 1 and so creating collisions when adding items with same hashCode • HashMap collision • Number of buckets is directly controllable by attacker • Oracle response: Won’t fix: Serialization should only be used in trusted environments 31
  • 32. Mitigation Advice #3: Defensive Deserialization 32 class DefensiveObjectInputStream extends ObjectInputStream { @Override protected Class<?> resolveClass(ObjectStreamClass cls) throws IOException, ClassNotFoundException { String className = cls.getName(); if ( /* CHECK CLASS NAME AGAINST ALLOWED/DISALLOWED TYPES */) { throw new InvalidClassException("Unexpected serialized class", className); } return super.resolveClass(cls); } }
  • 34. AnnotationInvocationHandler Gadget • “More serialization hacks with AnnotationInvocationHandler” • 9 Nov 2015 by Wouter Coekaerts (@WouterCoekaerts) • http://wouter.coekaerts.be/2015/annotationinvocationhandler • AnnotationInvocationHandler.equalsImpl() • “When we call equals on an annotation and give it an object implementing the same interface but not using AnnotationInvocationHandler, then it goes through all the methods on the interface and calls them on that object” 34 by Coekaerts
  • 35. JRE 7u21 Gadget • 18 Dec 2015 By Chris Frohoff (@frohoff) • https://gist.github.com/frohoff/24af7913611f8406eaf3 • LinkedHashSet • readObject() recover items from stream and call HashMap.put() • checks key’s hash code and if it already contains an item with same hash code, calls equals() 35 by Frohoff
  • 36. JRE 7u21 Gadget 36 HashMap PayloadObj a6f7b19c a6f7b19c Proxy (PayloadType) AnnotationInvocationHandler “f5a5a608” PayloadObjmemberValues by Frohoff
  • 38. Catch the exception • Back to Wouter post on AnnotationInvocationHandler tricks … • Modify the serialized stream and inject an object that catches the exception. Eg: • java.beans.beancontext.BeanContextSupport 38 by Coekaerts
  • 39. New JRE 8u20 Gadget 39 Chris Frohoff Gadget Wouter’s Technique Time :)
  • 40. New JRE 8u20 Gadget https://gist.github.com/pwntester/ab70e88821b4a6633c06 40 ~200 lines of payload construction code
  • 41. WHAT ABOUT OTHER LANGUAGES ON THE JVM? 41
  • 42. Scala & Groovy 42 import java.io._ object SerializationDemo extends App { val ois = new ObjectInputStream(new FileInputStream(“exploit.ser")) val o = ois.readObject() ois.close() } import java.io.* File exploit = new File('exploit.ser') try { def is = exploit.newObjectInputStream(this.class.classLoader) is.eachObject { println it } } catch (e) { throw new Exception(e) } finally { is?.close() } Source code: https://github.com/pwntester/JVMDeserialization
  • 44. How to Harden Your Applications? DO NOT DESERIALIZE UNTRUSTED DATA!! • When architecture permits it: – Use other formats instead of serialized objects: JSON, XML, etc. • But be aware of XML-based deserialization attacks via XStream, XmlDecoder, etc. As second-best option: – Use defensive deserialization with look-ahead OIS with a strict whitelist • Don’t rely on gadget-blacklisting alone! • You can build the whitelist with OpenSource agent SWAT 
 ( Serial Whitelist Application Trainer: https://github.com/cschneider4711/SWAT ) • Prefer an agent-based instrumenting of ObjectInputStream towards LAOIS • Scan your own whitelisted code for potential gadgets • Still be aware of DoS scenarios 44
  • 45. FINDING VULNERABILITIES & GADGETS IN THE CODE SAST Tips 45
  • 46. Finding deserialization endpoints • Check your endpoints for those accepting (untrusted) serialized data • Find calls to: • ObjectInputStream.readObject() • ObjectInputStream.readUnshared() • Where InputStream is attacker-controlled. For example: • May happen in library code. Eg: JMS, JMX, RMI, Queues, Brokers, Spring HTTPInvokers, etc … 46 InputStream is = request.getInputStream(); ObjectInputStream ois = new ObjectInputStream(ois); ois.readObject();
  • 47. Finding gadgets in a Haystack • Check your code for potential gadgets, which could be used in deserialization • "Gadget Space" is too big. Typical app-server based deployments have hundreds of JARs • SAST tools such as HPE Security Fortify SCA might help 47 Look for interesting method calls … java.lang.reflect.Method.invoke() java.io.File() java.io.ObjectInputStream() java.net.URLClassLoader() java.net.Socket() java.net.URL() javax.naming.Context.lookup() … … reached by: java.io.Externalizable.readExternal() java.io.Serializable.readObject() java.io.Serializable.readObjectNoData() java.io.Serializable.readResolve() java.io.ObjectInputValidation.validateObject() java.lang.reflect.InvocationHandler.invoke() java.lang.Object.finalize() Serializable InvocationHandlers …
  • 48. WHAT TO CHECK DURING PENTESTS? DAST Tips 48
  • 49. Passive deserialization endpoint detection • Find requests (or any network traffic) carrying serialized Java objects: • Easy to spot due to magic bytes at the beginning: 0xAC 0xED … • Some web-apps might use Base64 to store serialized data 
 in Cookies, etc.: rO0AB … • Be aware that compression could’ve been applied before Base64 • 0x1F8B 0x0800 … • H4sIA … • Tools • Use professional scanners for enterprise-level scans • Use Free ZAP/Burp Plugins such as SuperSerial to passively scan for Java serialization • Use WireShark for network traffic • If allowed to instrument the app use runtime agents such as SWAT to find out if anything gets deserialized 49
  • 50. Q & A / Thank You ! Chris9an Schneider @cschneider4711 mail@ChrisHan-Schneider.net Alvaro Muñoz @pwntester alvaro.munoz@hpe.com FAQ: 
 https://Christian-Schneider.net/JavaDeserializationSecurityFAQ.html Whitepaper: 
 https://community.hpe.com/t5/Security-Research/The-perils-of-Java- deserialization/ba-p/6838995 … and remember:
 DO NOT DESERIALIZE
 UNTRUSTED DATA!!