ODDFuzz: Hunting Java Deserialization Gadget Chains via Structure-Aware Directed Greybox Fuzzing

Although the Java deserialization vulnerability has been widely known for many years, it still poses a severe threat to security. The attackers and defenders both focus on hunting gadget chains, which are the key to actually exploiting the vulnerability.

There are some available tools that can be used to hunt for gadget chains automatically. Unfortunately, these tools struggle to address the following challenges: (1) Existing tools have difficulty making trade-offs between precision and recall, because runtime polymorphism and other dynamic …

attackers aware defenders deserialization exploiting focus fuzzing gadget hunting java java deserialization key security structure the key threat tools vulnerability