Seneca: Taint-Based Call Graph Construction for Java Object Deserialization

Object serialization and deserialization are widely used for storing and preserving objects in les, memory, or database as well as for transporting them across machines, enabling remote interaction among processes and many more. This mechanism relies on reection, a dynamic language that introduces serious challenges for static analyses. Current state-of-the-art call graph construction algorithms do not fully support object serialization/deserialization, i.e., they are unable to uncover the callback methods that are invoked when objects are serialized and deserialized. Since call graphs are a core data structure for multiple types of analysis (e.g., vulnerability detection), an appropriate analysis cannot be performed since the call graph does not capture hidden (vulnerable) paths that occur via callback methods. In this paper, we present S, an approach for handling serialization with improved soundness in the context of call graph construction. Our approach relies on taint analysis and API modeling to construct sound call graphs. We evaluated our approach with respect to soundness, precision, performance, and usefulness in detecting untrusted object deserialization vulnerabilities. Our results show that S can create sound call graphs with respect to serialization features. The resulting call graphs do not incur signicant runtime overhead and were shown to be useful for performing identication of vulnerable paths caused by untrusted object deserialization.

CCS Concepts: • Software and its engineering ! Automated static analysis; Software verication and validation.