A static code double-stream opposite analysis method for net deserialization vulnerability mining

Abstract

The application provides a static code double-flow opposite analysis method for Net anti-serialization vulnerability mining, which can perform more efficient code analysis on anti-serialization call connected paths, and greatly reduces the labor cost of vulnerability mining and analysis work. The method comprises the following steps: 1) reverse compilation of the object to be tested: using reverse compilation technology, the.NET assembly is reverse compiled into C# source code for analysis; 2) forward analysis of data flow: using automatic detection software to perform forward path analysis of data flow; 3) reverse analysis of control flow: using automatic analysis tools to perform reverse path analysis of control flow; 4) manual path matching: based on the double-flow opposite analysis results of data flow and control flow, manual matching and verification of vulnerability exploitation paths are performed. The method can effectively improve the analysis rate of C# code and the mining efficiency of anti-serialization vulnerabilities.

Description

TECHNICAL FIELD

[0001] The application proposes a double-flow opposite code analysis method based on static taint analysis technology for.NET platform deserialization vulnerability mining, which can perform more efficient code analysis on the deserialization call connected path. BACKGROUND

[0002] The serializer is a necessary component of information transmission and data storage application programs, so the deserialization function is widely used in various software on the.NET platform. However, when the software processes external input user data, the deserialization method is likely to be maliciously used, that is, when the application program trusts the user (or called attacker) too much, the user data is tampered and used, and the deserialization may cause serious network attacks.

[0003] When the following three conditions are met, a deserialization vulnerability is formed: (a) the serialized object is provided by the user or can be modified by the user; (b) the application attempts to bypass verification to deserialize and call the object; (c) the application contains a class library with exploitation value in the function call chain. Attackers can manipulate serialized objects and pass dangerous data to the application through the above conditions, or even replace the original serialized object with a completely different class. Any valuable object in the class library can be deserialized and instantiated, and the replacement of the object usually causes program errors, exceptions, but the attack may have been achieved before the deserialization is completed, which means that even if the application itself does not directly interact with malicious objects, the deserialization process itself can initiate an attack.

[0004] As can be seen, the deserialization risk in software can cause very serious consequences, because it greatly increases the attack range of various network threats. The deserialization entry point gives attackers the opportunity to implement code reuse attacks (Code-Reuse Attacks), thereby inducing other various vulnerabilities. The highest priority is RCE, which is extremely dangerous. Even in the case where RCE cannot be achieved, unsafe deserialization can also cause arbitrary file access, system privilege escalation, and DoS, etc. At the same time, according to the requirements of the vulnerability formation conditions, the application needs to have an open data entry to the outside, which can realize the data transmission of the user. At this time, the attacker inputs risk data from the user interface, and the malicious code in it can be transmitted to the deserialization method through the open entry, and the deserializer parses the data text, triggers the constructed deserialization call chain, and finally builds a system object that can be exploited by the attacker, realizing the control or destruction of the software system. In summary, the attack code is completely transmitted from the entry point of the deserialization method to the inside of the serializer to successfully trigger the deserialization call chain. The key in vulnerability mining is to confirm whether there is a connected path between the entry point and the open point to the outside through the analysis of the software code.

[0005] Among research methodologies targeting deserialization risks, white-box analysis is the most direct defense mechanism. It primarily relies on manual code auditing, but static analysis of C# assembly source code consumes significant time and effort and is highly dependent on the analyst's technical knowledge. Meanwhile, taint analysis, a commonly used method in program analysis to ensure information flow security, can effectively address issues such as information leakage and contamination in deserialization vulnerabilities. Summary of the Invention

[0006] To address the issue that .NET deserialization vulnerability discovery relies heavily on manual analysis and human experience, this invention provides a static code two-stream opposing analysis method for .NET deserialization vulnerability discovery.

[0007] To achieve the above-mentioned objectives, the present invention is implemented through the following specific technical solutions:

[0008] A static code two-stream opposing analysis method for .NET deserialization vulnerability discovery includes the following steps:

[0009] 1) Decompiling the object under test: Using decompilation technology, the .NET assembly is decompiled into C# source code for analysis;

[0010] 2) Forward data flow analysis: Analyze the forward path of the data flow using automated detection software;

[0011] 3) Control flow reverse analysis: Perform reverse path analysis of control flow using automated analysis tools;

[0012] 4) Manual path matching: Manual matching and verification of vulnerability exploitation paths based on the results of the two-way analysis of data flow and control flow.

[0013] Preferably, step 2) specifically includes the following steps:

[0014] Step 2.1: Select a suitable static stain analysis software to perform data flow analysis on the C# assembly to be tested;

[0015] Step 2.2: Select an appropriate analysis strategy and specify the taint source and sink in the static taint analysis process to perform forward analysis of the deserialization call connectivity path;

[0016] Step 2.3: Based on the static taint analysis software, obtain the path results of the forward analysis of the data flow.

[0017] Preferably, step 3) specifically includes the following steps:

[0018] Step 3.1: Select appropriate control flow graph (CFG) and function call graph (CG) generation tools to perform control flow analysis on the C# code;

[0019] Step 3.2: Perform reverse analysis of the deserialization call connectivity path based on CFG and CG generation tools to obtain the reverse path results of control flow analysis.

[0020] Preferably, step 4) specifically includes the following steps:

[0021] Step 4.1: Based on the forward path analysis results obtained in Step 2) and the reverse path analysis results obtained in Step 3), perform manual path matching;

[0022] Step 4.2: Verify the deserialization call process based on the connection path of the two-stream reciprocating matching, that is, prove the feasibility and severity of the deserialization vulnerability through vulnerability exploitation experiments (Proof of Concept, PoC).

[0023] Preferably, in step 2.2, the software code analysis adopts a false positive analysis strategy, that is, "over-analyzing" all possible connected paths in the program; theoretically, a perfect static analysis report should accurately reflect all errors; however, in practice, two results often occur: missed reports and false positives; a missed report means that the errors included in the analysis report are real vulnerabilities, but there are still undiscovered vulnerabilities in the program; a false positive means that the results report all errors, but it cannot be guaranteed that these vulnerabilities are valid.

[0024] The specific steps of the false alarm strategy are as follows: In the process of customizing the dirty analysis rule table of the security code scanner, all possible Sources and Sinks are included in the analysis scope; the first step is to summarize and mark the external data receiving points in .NET in the Source definition table of SCS and formulate rules; the second step is to formulate analysis rules for Sinks.

[0025] Meanwhile, the key to using SCS static taint analysis lies in marking the Source and Sink in the C# source code being tested; defining the external input point of the .NET program under test as Source, and the deserialization entry point within the program as Sink; after determining the starting point Source and the ending point Sink, SCS automatically analyzes the information flow of the program code.

[0026] Preferably, in the step 3.1, the method of combining the Doxygen tool and the GraphViz tool is selected; the Doxygen tool extracts the code structure to automatically generate the method dependency, type inheritance and function call relationship and other information according to the content of the.NET program itself; the GraphViz is an open source tool for drawing the DOT script language description graph, and based on the program information given by the Doxygen, the GraphViz automatically generates the CG graph for the control flow analysis; the visualized graph information is used for analyzing and judging whether the path in the SCS report is feasible, even if the false alarm is generated, it is filtered and removed, so as to avoid the waste of analysis resources and improve the overall efficiency of the code analysis.

[0027] Preferably, in the step 3.2, in the case that the step 2.2 generates "over analysis" so that the vulnerability detection efficiency is reduced, the method of auxiliary analysis according to the control flow information is used for solving; the construction of the CFG and the CG is used for analyzing the specific calling flow of the deserialization method in the program, and the deserialization method caller is analyzed, that is, the upward tracking is performed from the deserialization risk entry point, and the function relationship path of the risk point directly called by the external environment is acquired.

[0028] Compared with the prior art, the present application has the following advantages:

[0029] 1. The method of the present application is based on static taint analysis, combined with related automatic tools and C# decompilation software, and realizes more efficient code static analysis and risk path tracking, so as to improve the overall efficiency of.NET deserialization vulnerability mining.

[0030] 2. The method of the present application is more efficient in code analysis of the deserialization calling connected path, and greatly reduces the labor cost in vulnerability mining and analysis work. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 It is a flowchart of the method of the present application.

[0032] Figure 2 It is the inclusion relationship of false alarm, real vulnerability and false negative.

[0033] Figure 3 It is a Source custom rule representation example diagram.

[0034] Figure 4 It is a Sink custom rule representation example diagram.

[0035] Figure 5 It is a working interface diagram, wherein (a) is the working interface of Security Code Scan; (b) is the result file of the forward analysis of Security Code Scan.

[0036] Figure 6 Setting interface diagram, wherein (a) is the setting interface of Doxygen client; (b) is the visualization result of GraphViz.

[0037] Figure 7 Working interface diagram, wherein (a) is the artificial analysis window of dnSpy; (b) is the working interface of ysoserial.net.

[0038] Figure 8 Vulnerability information page, wherein (a) is the Snyk vulnerability information page of CVE-2022-21167; (b) is the Snyk vulnerability information page of CVE-2022-0749. DETAILED DESCRIPTION

[0039] The application will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0040] As Figure 1 shown, a static code double-flow opposite analysis method for Net deserialization vulnerability mining, comprising the following steps:

[0041] 1) Reverse compilation of the object to be tested: using reverse compilation technology, the.NET assembly is reverse compiled into C# source code for analysis;

[0042] 2) Forward analysis of data flow: forward path analysis of data flow is performed by automatic detection software;

[0043] 3) Reverse analysis of control flow: reverse path analysis of control flow is performed by automatic analysis tool;

[0044] 4) Artificial path matching: artificial matching and verification of vulnerability exploitation paths based on the double-flow opposite analysis results of data flow and control flow.

[0045] Preferably, in step 1), dnSpy reverse compilation software based on ILSpy reverse compilation engine and Roslyn official compiler is selected to reconstruct the.NET assembly to be detected into a project file, and C# source code is obtained.

[0046] The step 2) specifically comprises the following steps:

[0047] Step 2.1, selecting appropriate static taint analysis software to analyze the data flow of the C# assembly to be detected;

[0048] Step 2.2, selecting appropriate analysis strategy, and specifying taint source and burst point in the static taint analysis process, and performing forward analysis of deserialization call connected path;

[0049] Step 2.3, based on static taint analysis software, obtain the path results of data flow forward analysis.

[0050] Preferably, in step 2.1, a security code scanner (SCS) is selected as the data flow analysis tool, and the SCS is an open source static code analyzer for.NET platform code, which is built-in with the official compiler Roslyn analyzer of.NET, and detects the vulnerability conditions in C# and VB codes based on the OWASP Top 10 report, and supports inter-process tainting analysis of application input data.

[0051] Preferably, in step 2.2, the software code analysis adopts a false positive analysis strategy, that is, all possible connected paths in the program are analyzed. In theory, a perfect program static analysis report should truly reflect all the errors; however, in actual operation, two results are often generated, false negatives and false positives. False negatives refer to the errors contained in the analysis report are all real vulnerabilities, but there may be undiscovered vulnerabilities in the program; false positives indicate that all the errors are reported in the results, but it cannot be guaranteed that these vulnerabilities are true. The inclusion relationship among the real vulnerabilities, false positives, and false negatives can be represented as shown in the figure. Figure 2

[0052] The specific operation of the false positive strategy is as follows: in the process of customizing the SCS tainting analysis rule table, all possible Sources and Sinks are included in the analysis range. First, the external data receiving points in.NET are summarized and marked in the Source definition table of SCS, and part of the rules are as shown in the table. Figure 3 Second, the analysis rules about Sink are formulated, and part of the marked definition contents are shown in the table. Figure 4 However, the false positive analysis strategy inevitably leads to an increase in the inspection cost.

[0053] At the same time, the key point of using SCS static taint analysis is to mark the Source and Sink in the detected C# source code. The method defines the external input point of the.NET program to be tested as the Source, and the deserialization entry point in the program as the Sink. After the starting point Source and the ending point Sink are determined, SCS can automatically analyze the information flow of the program code.

[0054] Figure 5 (a) shows the working interface of SCS; Figure 5 (b) shows the result file of SCS forward analysis.

[0055] The step 3) specifically comprises the following steps:

[0056] ​Step 3.1, select appropriate control flow graph (CFG) and function call graph (CG) generation tools to perform control flow analysis on C# code;

[0057] Step 3.2, based on the CFG and CG generation tools to perform reverse analysis of deserialization call connected path, obtain the reverse path result of control flow analysis.

[0058] Preferably, in step 3.1, the method of combining Doxygen tool and GraphViz tool is used. Doxygen tool extracts code structure and automatically generates method dependency, type inheritance and function call relationship information according to the content of.NET program itself; GraphViz is an open source tool for drawing DOT script language description graph. Based on the program information given by Doxygen, GraphViz can automatically generate CG graphics for control flow analysis. Visual graphics information is used to analyze and judge whether the path in SCS report is feasible, so as to filter and eliminate false positives, avoid waste of analysis resources and improve the overall efficiency of code analysis.

[0059] Preferably, in step 3.2, in the case of "over analysis" caused by step 2.2, the method of auxiliary analysis according to control flow information is used to solve the problem. CFG and CG are used to analyze the specific call flow of deserialization method in the program, and the function relationship path of risk point called by external environment is obtained by analyzing the deserialization method caller, that is, starting from the deserialization risk entry point and tracking upward.

[0060] Figure 6 (a) shows the setting interface of Doxygen client; Figure 6 (b) shows the visualization result of GraphViz.

[0061] The step 4) specifically comprises the following steps:

[0062] Step 4.1, according to the forward analysis path result obtained in step 2) and the reverse analysis path result obtained in step 3), manual path matching is performed;

[0063] Step 4.2, based on the connected path matched by double flow opposite matching, the verification of deserialization call process is performed, that is, the feasibility and severity (Proof of Concept, PoC) of deserialization vulnerability is proved by vulnerability exploitation experiment.

[0064] Further, in step 4.1, dnSpy decompilation software is used to analyze C# source code based on the path result matched by double flow opposite analysis.

[0065] Further, in step 4.2, the ysoserial.net tool is used to construct the payload required for the PoC experiment.

[0066] Figure 7 (a) shows the artificial analysis window of dnSpy; Figure 7 (b) shows the working interface of ysoserial.net.

[0067] Specific implementation cases

[0068] In the comparative experiment of deserialization vulnerability analysis, three different methods of single data flow analysis, single control flow analysis and double flow analysis are used, and the complete analysis time is recorded. The hardware and software information of the experiment is: processor Intel Core i7-8750H; memory size 16GB; operating system Windows 10 Professional 64-bit (21H2); single data flow analysis is only through SCS (v5.6.2) for taint analysis; single control flow analysis refers to using Fortify SCA (v19.1.0) for control flow analysis. The experimental results are shown in Table 1, the single data flow analysis method is the lowest in efficiency, and the time cost is high; the detection speed of single control flow method is faster, but its vulnerability detection rate is very low; compared with the former two, the double flow analysis method greatly improves the efficiency of code analysis, and can detect 100% of the deserialization vulnerabilities, and the efficiency of the method of the present application is verified successfully.

[0069] Table 1 Comparison of CVE vulnerability analysis experiment completion time results

[0070] CVE Case Number Single Data Flow Analysis Single Control Flow Analysis Dual Flow Analysis CVE-2022-21167 4921 seconds Not detected 2167 seconds CVE-2021-32796 4221 seconds Not detected 2046 seconds CVE-2021-29508 4806 seconds Not detected 2346 seconds CVE-2020-25258 5611 seconds Not detected 2788 seconds CVE-2020-10914 5447 seconds Not detected 2167 seconds CVE-2019-18935 3653 seconds 207 seconds 1325 seconds CVE-2019-10068 3050 seconds 170 seconds 908 seconds CVE-2017-9822 3434 seconds 173 seconds 1025 seconds

[0071] Based on the double flow analysis method proposed for the deserialization risk of open source.NET software and its dependencies, through vulnerability mining test on a large number of vulnerability risk components, two unknown.NET vulnerabilities are newly discovered, and detailed reports of unknown vulnerabilities are submitted to Snyk, a well-known network security manufacturer in the United States.

[0072] Both unknown vulnerabilities have been identified as High-risk and assigned corresponding CVE numbers: Masuit.Tools.Core library vulnerability CVE-2022-21167, with a CVSS baseline score of 7.5; and SinGooCMS.Utility library vulnerability CVE-2022-0749, with a CVSS baseline score of 7.4. The Snyk database links for CVE-2022-21167 and CVE-2022-0749 are: https: / / security.snyk.io / vuln / SNYK-DOTNET-MASUITTOOLSCORE-2316875 and https: / / security.snyk.io / vuln / SNYK-DOTNET-SINGOOCMSUTILITY-2312979, respectively. The Snyk vulnerability information page for CVE-2022-21167 is as follows... Figure 8 As shown in (a), the Snyk vulnerability information page for CVE-2022-0749 is as follows: Figure 8 As shown in (b).

[0073] In summary, the static code dual-stream opposing analysis method for .NET deserialization vulnerability mining described in the above embodiments of the present invention can perform more efficient code analysis on the deserialization call connectivity path, greatly reducing the manpower cost of vulnerability mining and analysis. The method includes the following steps:

[0074] 1) Decompiling the object under test: Using decompilation technology, the .NET assembly is decompiled into C# source code for analysis;

[0075] 2) Forward data flow analysis: Automated detection software is used to perform forward path analysis of the data flow;

[0076] 3) Control flow reverse analysis: Use automated analysis tools to perform reverse path analysis of control flow;

[0077] 4) Manual Path Matching: Based on the results of bidirectional analysis of data flow and control flow, manual matching and verification of exploit paths are performed. This invention effectively improves the analysis speed of C# code and the efficiency of deserialization vulnerability discovery.

[0078] The embodiments of the present invention have been described above in conjunction with the accompanying drawings. However, the present invention is not limited to the above embodiments. Various changes can be made according to the purpose of the invention. Any changes, modifications, substitutions, combinations or simplifications made based on the spirit and principle of the technical solution of the present invention shall be equivalent substitutions. As long as they meet the purpose of the invention and do not deviate from the technical principle and inventive concept of the present invention, they shall fall within the protection scope of the present invention.

Claims

1. A static code two-stream opposing analysis method for .NET deserialization vulnerability mining, characterized in that, Includes the following steps: 1) Decompiling the object under test: Using decompilation technology, the .NET assembly is decompiled into C# source code for analysis; 2) Forward data flow analysis: Analyze the forward path of the data flow using automated detection software; 3) Control flow reverse analysis: Perform reverse path analysis of control flow using automated analysis tools; 4) Manual path matching: Manual matching and verification of exploit paths based on the results of the two-way analysis of data flow and control flow; Step 4) specifically includes the following steps: Step 4.1: Based on the forward path analysis results obtained in Step 2) and the reverse path analysis results obtained in Step 3), perform manual path matching; Step 4.2: Verify the deserialization call process based on the connection path of the two streams in opposite directions, that is, prove the feasibility and severity of the deserialization vulnerability through vulnerability exploitation experiments.

2. The static code two-stream opposing analysis method for NET deserialization vulnerability mining according to claim 1, characterized in that, Step 2) specifically includes the following steps: Step 2.1: Select a suitable static stain analysis software to perform data flow analysis on the C# assembly to be tested; Step 2.2: Select an appropriate analysis strategy and specify the taint source and outbreak point in the static taint analysis process to perform forward analysis of the deserialization call connection path; Step 2.3: Based on the static taint analysis software, obtain the path results of the forward analysis of the data flow.

3. The static code two-stream opposing analysis method for NET deserialization vulnerability mining according to claim 1, characterized in that, Step 3) specifically includes the following steps: Step 3.1: Select appropriate Control Flow Graph (CFG) and Function Call Graph (CG) generation tools to perform control flow analysis on the C# code; Step 3.2: Perform reverse analysis of the deserialization call connectivity path based on CFG and CG generation tools to obtain the reverse path results of control flow analysis.

4. The static code two-stream opposing analysis method for NET deserialization vulnerability mining according to claim 2, characterized in that, In step 2.2, the software code analysis adopts a false positive analysis strategy, that is, "over-analyzing" all possible connected paths in the program; the program static analysis report reflects two results: false negatives and false positives; false negatives mean that the errors included in the analysis report are real vulnerabilities, but there are still undiscovered vulnerabilities in the program; false positives mean that the results report all errors, but it cannot be guaranteed that these vulnerabilities are valid. The specific steps of the false alarm strategy are as follows: In the process of customizing the dirty analysis rule table of the security code scanner, all possible Sources and Sinks are included in the analysis scope; the first step is to summarize and mark the external data receiving points in .NET in the Source definition table of SCS and formulate rules; the second step is to formulate analysis rules for Sinks. Meanwhile, the key to using SCS static taint analysis lies in marking the Source and Sink in the C# source code being tested; defining the external input point of the .NET program under test as Source, and the deserialization entry point within the program as Sink; after determining the starting point Source and the ending point Sink, SCS automatically analyzes the information flow of the program code.

5. The static code two-stream opposing analysis method for NET deserialization vulnerability mining according to claim 3, characterized in that, In step 3.1, a combination of the Doxygen and GraphViz tools is used to complete the task; the Doxygen tool extracts code structure information such as method dependencies, type inheritance, and function call relationships based on the content of the .NET program itself. GraphViz is an open-source tool for drawing graphs described by the DOT scripting language. Based on the program information provided by Doxygen, GraphViz automatically generates graphs such as CG for use in control flow analysis. The visualized graphical information is used to analyze and determine whether the path in the SCS report is feasible.

6. The static code two-stream opposing analysis method for NET deserialization vulnerability mining according to claim 3, characterized in that, In step 3.2, in response to the situation in step 2.2 where "over-analysis" leads to a decrease in vulnerability detection efficiency, a method of auxiliary analysis based on control flow information is used to solve the problem. The construction of CFG and CG is used to analyze the specific call flow of the deserialization method in the program. The analysis is performed on the caller of the deserialization method, that is, starting from the entry point of deserialization risk and tracing upwards to obtain the function relationship path of the risk point being directly called by the external environment.

Images