反序列化漏洞研究综述

Deserialization vulnerabilities: a review

摘要:

随着互联网技术的高速发展,应用程序与服务之间的数据交换日趋攀升。序列化机制为跨平台数据传输和交互提供了便利,在网络编程、数据持久化和分布式系统等应用程序中应用广泛,由其产生的反序列化漏洞问题也逐渐引发关注。攻击者注入精心构造的恶意对象以利用该漏洞实现远程代码执行等恶意行为,造成数据泄露、系统崩溃、服务中断等后果, 严重威胁应用安全和用户隐私安全。因此,亟须对反序列化漏洞的原理及检测等相关研究进行系统性梳理和分析。介绍了反序列化漏洞背景和发展历史,以典型案例来阐述反序列化漏洞的实现原理,提炼了反序列化漏洞检测的一般方法,对学术界和工业界相关研究工作的原理进行了剖析。最后,根据相关技术的发展现状,讨论分析了反序列化漏洞未来可行的研究方向。

Abstract:

With the rapid development of Internet technology, the data exchange between applications and services is increasing. The serialization mechanism provides convenience for cross platform data transmission and interaction, and is widely used in applications such as network programming, data persistence, and distributed systems. However, deserialization vulnerabilities caused by them have gradually attracted attention. Attackers inject maliciously crafted objects and then exploit these vulnerabilities to achieve remote code execution and other malicious behaviors, leading to data leakage, system crash, service interruption and other consequences, seriously threatening application security and user privacy security. Therefore, it is urgent to systematically sort out and analyze the principles and detection of deserialization vulnerabilities. This review introduced the background and development history of deseriali zation vulnerabilities, explained the implementation principles of deserialization vulnerabilities through specific cases, extracted general methods for detecting deserialization vulnerabilities,