Forging Chains: The Java Blacksmith

Abstract

We present a tool to automatically extract gadget chains from arbitrary combinations of classes on the Java class path - outside the lab environment. The aim is to demonstrate that patching chains makes no sense: deserializing arbitrary attacker-controlled objects is the vulnerability, not the chain. When a program is found to write past the bounds of its buffer, developers will eagerly fix the buffer overflow, whether proven to be exploitable or not. In contrast, when it is found to deserialize arbitrary attacker-controlled objects, you will find that developers would like to hold on to this particularly flexible way of passing objects between processes because it is a feature they love and cherish.