Collected research
Efficient Detection of Java Deserialization Gadget Chains via Bottom-up Gadget Search and Dataflow-aided Payload Construction
Finds Java deserialization gadget chains by searching bottom-up from sinks to sources over reusable gadget fragments, cutting static search cost from exponential to polynomial, then fuzzes using a diagram of dataflow dependencies between injected objects' fields so payload objects get the right structure. It found 127 zero-day exploitable chains in six real applications.
Record
- Researcher
- Bofei Chen, Lei Zhang, Xinyou Huang, Yinzhi Cao, Keke Lian, Yuan Zhang and Min Yang
- Published by
- secsys.fudan.edu.cn
- Format
- Whitepaper
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Bofei Chen, Lei Zhang, Xinyou Huang, Yinzhi Cao, Keke Lian, Yuan Zhang and Min Yang, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .