Fastjson deserialization vulnerability call chain mining method and system

Abstract

The fastjson deserialization vulnerability call chain mining method and system comprise the following steps: configuring a Webhook of a code repository; receiving updated project information, identifying the URL address of the project code, and storing the Java source code of the project; parsing the Java source code into an abstract syntax tree and then converting it into a Python dictionary tree; detecting whether the Java source code references or uses the Fastjson library and whether a fastjson vulnerability version exists; detecting whether a JSON string exists; detecting whether a JSON string is deserialized into an object and whether the object is operated, and verifying whether an injection vulnerability exists; and determining whether a fastjson deserialization vulnerability exists, and if so, outputting the call chain result of the fastjson deserialization vulnerability. The present application greatly reduces the burden of manual mining and improves the mining efficiency and accuracy.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, and in particular to a method and system for mining call chains of Fastjson deserialization vulnerabilities. Background Technology

[0002] Fastjson is a high-performance Java JSON parsing library developed by Alibaba. It can be used to convert Java objects into their JSON representation and is widely used in Java development by enterprises. However, Fastjson also has some security risks, the most common of which is the deserialization vulnerability. A Fastjson deserialization vulnerability means that an attacker can construct malicious JSON data and trigger the deserialization vulnerability during Fastjson parsing, thereby allowing the attacker to execute arbitrary commands or code.

[0003] Currently, there are several tools for discovering vulnerabilities in Fastjson deserialization. These tools typically construct different data inputs based on Fastjson's syntax rules and parsing process, and observe the program's behavior to determine if the program has vulnerabilities; some even directly determine the presence of vulnerabilities based on the Fastjson version.

[0004] However, existing vulnerability discovery methods have some drawbacks. First, because Fastjson's syntax and parsing methods are very complex, various data inputs need to be constructed to comprehensively check the program's security, requiring significant computational resources and time, and even then, it may not cover all possible vulnerabilities. Second, because Fastjson updates relatively quickly, attackers' methods are constantly evolving. Therefore, existing automated vulnerability discovery methods struggle to keep up with these changes, making it difficult to ensure system security.

[0005] In other words, existing technologies suffer from low mining efficiency and accuracy. Summary of the Invention

[0006] The main objective of this invention is to provide a method, apparatus, device, and storage medium for mining fastjson deserialization vulnerability call chains, aiming to solve the technical problem of low mining efficiency and accuracy of existing fastjson deserialization vulnerability call chain mining methods.

[0007] To achieve the above objectives, this invention provides a method for mining call chains that exploit Fastjson deserialization vulnerabilities, comprising the following steps: S1, configuring a Webhook for the project code repository; when the project code repository is updated, automatically pushing the updated project information to a specified Webhook URL; the project information includes at least the URL address of the project code; S2, upon receiving the updated project information, identifying the URL address of the project code, and storing the project's Java source code through the project code repository's interface or by cloning; S3, parsing the Java source code into an abstract syntax tree, and then converting the abstract syntax tree into a Python trie; S4, traversing the Python trie to detect whether the Java source code references or uses the Fastjson library and whether a vulnerable version of Fastjson exists; if so, proceeding to step S5.

[0008] S5. Traverse the Python trie to check for parsing vulnerabilities in the JSON string. If so, proceed to step S6. S6. Traverse the Java source code to check for instances where the JSON string is deserialized into an object and then manipulated. Verify for injection vulnerabilities. If so, proceed to step S7. S7. Determine if a fastjson deserialization vulnerability exists. If so, traverse the calling functions to find the call chain and output the call chain results containing the fastjson deserialization vulnerability.

[0009] Optionally, the project details in step S1 may also include the project ID and the project name.

[0010] Optionally, step S3, parsing the Java source code into an abstract syntax tree, specifically includes the following steps: performing syntax analysis on the Java source code, decomposing the Java source code into a series of tokens; performing syntax analysis again, combining the series of tokens into an abstract syntax tree.

[0011] Optionally, step S3 converts the abstract syntax tree into a Python trie, specifically including the following steps: obtaining the AST node of the abstract syntax tree and using it as a parameter; determining the type of the AST node; if the AST node is an object of type javalang.ast.Node, then creating an empty dictionary, traversing all attributes of the AST node, using the attribute name as the key of the dictionary, and using the return value of the attribute value after recursion as the value of the dictionary, and finally returning the dictionary; if the AST node is an object of type list, then creating an empty list, traversing each element of the list, adding the return value of each element after recursion to the list, and finally returning the list; if the AST node is of other types, then directly returning the node.

[0012] Optionally, step S4 specifically includes the following steps: S40, traverse all import statements in the Python trie and search for import statements that begin with "com.alibaba.fastjson". If so, mark them as True; S41, traverse all classes and methods in the Python trie and search for code that uses the Fastjson library. Specifically, traverse the statement list of each method and search for any statement that contains the string "com.alibaba.fastjson". If so, mark it as True; S42, determine the version of "com.alibaba.fastjson". If the version is less than 1.2.80, mark it as True. The result indicates that the Java source code references or uses the Fastjson library and that a vulnerable version of Fastjson exists. Then, proceed to step S5.

[0013] Optionally, step S5 specifically includes the following steps: S50, traverse the Python trie and check if there is a statement containing the string "JSON.parse". If so, extract the JSON string from it; S51, check if the JSON string has a parsing vulnerability, specifically check if the JSON string starts or ends with a double quote. If so, the JSON string does not have a parsing vulnerability; if not, the JSON string has a parsing vulnerability, and proceed to step S6.

[0014] Optionally, step S6 specifically includes the following steps: S60, traverse all type declarations in the Java source code and check if there are any fields that start with the keyword "private"; if so, add the name of the field to the list; S61, traverse all JSON strings and check if they are contained in any class name in the list; if so, it indicates that the JSON string may have a deserialization injection vulnerability, and then proceed to step S7.

[0015] Optionally, step S7 specifically includes the following steps: S70, taking the Python trie as a parameter, traversing all function calls in the Java source code, and determining whether it is a Fastjson JSON parsing call; if so, recursively traversing the code inside the parsing call and executing step S71; S71, checking whether there are still Fastjson JSON parsing calls; if so, returning to step S70, until a function or location without a Fastjson remote code execution vulnerability is detected, and then outputting the call chain result with the Fastjson deserialization vulnerability; specifically, outputting the call chain result with the Fastjson deserialization vulnerability involves saving the call chain result with the Fastjson deserialization vulnerability and the URL address of the project code to the database, and then retrieving the project address and the call chain with the Fastjson deserialization vulnerability from the database through the Python Flask interface development framework and returning them.

[0016] Optionally, the call chain is maintained through a call chain list. During recursive traversal, the call chain list is passed to the next level until the traversal ends; at the end of each traversal, the call chain list is displayed.

[0017] Corresponding to the fastjson deserialization vulnerability call chain mining method, this invention provides a fastjson deserialization vulnerability call chain mining system, which includes: a project code retrieval module, used to configure the code repository webhook, and automatically push the updated project information to the specified webhook when the project code repository is updated. The project information includes at least the URL address of the project code; and a URL address used to identify the project code upon receiving updated project information, storing the project's Java source code via the project code repository interface or cloning. The project code parsing module parses the Java source code into an abstract syntax tree (AST), and then converts the AST into a Python trie (T). The fastjson deserialization vulnerability call chain traversal module traverses the Python trie to detect whether the Java source code references or uses the Fastjson library and whether a vulnerable version of Fastjson exists; it also traverses the Python trie to detect if there are parsing vulnerabilities in JSON strings; it traverses the Java source code to detect if there are instances of deserializing JSON strings into objects and manipulating those objects, and verifies for injection vulnerabilities; it also determines if a Fastjson deserialization vulnerability exists, and if so, traverses the called functions to find the call chain. The result output module outputs the call chain results for cases with Fastjson deserialization vulnerabilities.

[0018] The beneficial effects of this invention are:

[0019] (1) Compared with the prior art, the present invention realizes the automated mining of fastjson deserialization vulnerability call chains, which greatly reduces the burden of manual mining and improves mining efficiency and accuracy; by detecting whether there is a fastjson vulnerability version, detecting whether there is a parsing vulnerability in the JSON string, detecting whether there is a situation where the JSON string is deserialized into an object and the object is operated, and verifying whether there is an injection vulnerability, the present invention can comprehensively identify all call chains and attack paths, avoiding attack events caused by multiple call chains; by combining the three detection results, the present invention can accurately discover the links and entry points of fastjson remote code execution vulnerability, and help enterprises to comprehensively fix the vulnerability;

[0020] (2) Compared with the prior art, the present invention parses Java source code into an abstract syntax tree (AST), which facilitates code analysis and processing and helps to improve the efficiency of automated mining.

[0021] (3) Compared with the prior art, the present invention transforms the abstract syntax tree into a Python trie, which facilitates the processing and display of node information in the AST; using the Python trie, a node information in the AST can be quickly found by key-value pairs, and it supports traversal, search, modification and other operations, which is convenient for secondary development and expansion; in addition, the Python trie also supports some serialization, file reading and writing, network transmission and other functions, which makes it convenient to convert the AST into other data formats such as JSON and XML;

[0022] (4) Compared with the prior art, the present invention displays the call chain list at the end of each recursive traversal to facilitate the continued traversal of other function calls and improve the mining efficiency. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0024] Figure 1 A simplified flowchart of a fastjson deserialization vulnerability call chain mining method provided in an embodiment of the present invention;

[0025] Figure 2 This is a simplified structural diagram of a fastjson deserialization vulnerability call chain mining system provided in an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] like Figure 1 As shown, the present invention provides a method for mining call chains of Fastjson deserialization vulnerabilities, which includes the following steps: S1, configuring a Webhook for the project code repository, so that when the project code repository is updated, the updated project information is automatically pushed to the specified Webhook. The project information must include at least the URL of the project code; S2, upon receiving updated project information, identify the URL of the project code and store the Java source code of the project through the project code repository interface or cloning; S3, parse the Java source code into an abstract syntax tree, and then convert the abstract syntax tree into a Python trie; S4, traverse the Python trie to check if the Java source code references or uses the Fastjson library and if a vulnerable version of Fastjson exists. If so, proceed to step S5; S5, traverse the Python trie to check if there is a parsing vulnerability in the JSON string. If so, proceed to step S6; S6, traverse the Java source code to check if there is a situation where the JSON string is deserialized into an object and the object is manipulated, and verify if there is an injection vulnerability. If so, proceed to step S7; S7, determine if there is a Fastjson deserialization vulnerability. If so, traverse the called functions to find the call chain and output the call chain result with the Fastjson deserialization vulnerability.

[0028] This invention automates the discovery of call chains for Fastjson deserialization vulnerabilities, significantly reducing the burden of manual discovery and improving efficiency and accuracy. It detects the existence of vulnerable Fastjson versions, JSON string parsing vulnerabilities, and instances of deserializing JSON strings into objects and manipulating those objects, combined with verification of injection vulnerabilities, to comprehensively identify all call chains and attack paths, preventing attacks caused by multiple call chains. By integrating the results of these three detections, it accurately identifies the links and entry points for Fastjson remote code execution vulnerabilities, helping enterprises comprehensively patch vulnerabilities.

[0029] In this embodiment, the detailed information of the project in step S1 also includes the project ID and the project name.

[0030] In this embodiment, step S3, parsing the Java source code into an abstract syntax tree, specifically includes the following steps: performing syntax analysis on the Java source code to decompose it into a series of tokens; performing syntax analysis again to combine the series of tokens into an abstract syntax tree.

[0031] This invention parses Java source code into an Abstract Syntax Tree (AST), facilitating code analysis and processing and improving the efficiency of automated code mining. An Abstract Syntax Tree is a result tree that represents the abstract syntactic structure of a program, facilitating subsequent syntactic analysis.

[0032] In this embodiment, step S3, which converts the Abstract Syntax Tree (AST) into a Python Trie, specifically includes the following steps: obtaining the AST node of the AST and using it as a parameter; determining the type of the AST node; if the AST node is an object of type javalang.ast.Node, creating an empty dictionary, traversing all attributes of the AST node, using the attribute name as the key of the dictionary, and using the attribute value as the return value of the recursive call as the value of the dictionary, and finally returning the dictionary; if the AST node is an object of type list, creating an empty list, traversing each element of the list, adding the return value of each element to the list, and finally returning the list; if the AST node is of other types, directly returning the node.

[0033] This invention transforms the Abstract Syntax Tree (AST) into a Python Trie, facilitating the processing and display of node information in the AST. Using the Python Trie, a specific node in the AST can be quickly found using key-value pairs, and it supports operations such as traversal, searching, and modification, making it convenient for secondary development and expansion. In addition, the Python Trie also supports functions such as serialization, file reading and writing, and network transmission, making it easy to convert the AST into other data formats such as JSON and XML.

[0034] In this embodiment, step S4 specifically includes the following steps: S40, traverse all import statements in the Python trie and search for import statements that begin with "com.alibaba.fastjson". If so, mark them as True; S41, traverse all classes and methods in the Python trie and search for code that uses the Fastjson library. Specifically, traverse the statement list of each method and search for any statement that contains the string "com.alibaba.fastjson". If so, mark it as True; S42, determine the version of "com.alibaba.fastjson". If the version is less than 1.2.80, mark it as True. The determination result is that the Java source code references or uses the Fastjson library and a vulnerable version of Fastjson exists. Then, proceed to step S5.

[0035] It should be noted that the import mentioned above refers to a fixed keyword used when the code references other packages, and the import statement is a statement that contains this keyword.

[0036] In this embodiment, step S5 specifically includes the following steps: S50, traverse the Python trie and check if there is a statement containing the string "JSON.parse". If so, extract the JSON string; S51, check if the JSON string has a parsing vulnerability, specifically check if the JSON string starts or ends with double quotes. If so, the JSON string does not have a parsing vulnerability; otherwise, the JSON string has a parsing vulnerability, and proceed to step S6. Because in Java code, if the JSON string uses double quotes to fix variables, it will not receive variable parameters, so there is no possibility of a fastjson deserialization vulnerability; if the JSON string uses other symbols or contains other Java class names or even keywords, then a fastjson deserialization vulnerability will exist when using the Fastjson library for parsing. Therefore, step S6 further traverses all type declarations in the Java source code and all JSON strings to check if there is a situation where the JSON string is deserialized into an object and the object is manipulated, and verifies whether there is an injection vulnerability, so that S7 can determine whether a fastjson deserialization vulnerability exists.

[0037] In this embodiment, step S6 specifically includes the following steps: S60, traverse all type declarations in the Java source code and check if there are any fields that start with the keyword "private"; if so, add the name of the field to the list; S61, traverse all JSON strings and check if they are contained in any class name in the list; if so, it indicates that the JSON string may have a deserialization injection vulnerability (because an attacker can execute remote code by constructing a malicious JSON string), then proceed to step S7.

[0038] It should be noted that `private` is a fixed keyword used when referencing other packages in code.

[0039] In this embodiment, step S7 specifically includes the following steps: S70, using the Python trie as a parameter, traverse all function calls in the Java source code to determine if they are Fastjson JSON parsing calls; if so, recursively traverse the code inside the parsing call and execute step S71; S71, check if there are still Fastjson JSON parsing calls; if so, return to step S70 until a function or location without a Fastjson remote code execution vulnerability is detected, and then output the call chain result with the Fastjson deserialization vulnerability; specifically, outputting the call chain result with the Fastjson deserialization vulnerability involves saving the call chain result with the Fastjson deserialization vulnerability and the URL address of the project code to the database, and then retrieving the project address and the call chain with the Fastjson deserialization vulnerability from the database through the Python Flask interface development framework and returning them.

[0040] Preferably, the call chain is maintained through a call chain list. During recursive traversal, the call chain list is passed to the next level until the traversal ends; at the end of each traversal, the call chain list is displayed.

[0041] During recursive traversal, this invention displays a call chain list at the end of each traversal to facilitate the continued traversal of other function calls and improve mining efficiency.

[0042] Corresponding to the fastjson deserialization vulnerability call chain mining method, such as Figure 2As shown, this invention provides a Fastjson deserialization vulnerability call chain mining system, which includes: a project code retrieval module 10, used to configure the code repository's webhook, and automatically push the updated project information to the specified webhook when the project code repository is updated. The project information includes at least the URL address of the project code; and the URL address used to identify the project code when updated project information is received, storing the project's Java source code through the project code repository interface or cloning; the project code parsing module 20 is used to parse the Java source code into an abstract syntax tree, and then convert the abstract syntax tree into a Python trie; the fastjson deserialization vulnerability call chain traversal module 30 is used to traverse the Python trie, detect whether the Java source code references or uses the Fastjson library, and whether a vulnerable version of fastjson exists; traverse the Python trie to detect whether there is a parsing vulnerability in the JSON string; traverse the Java source code to detect whether there is a situation in the Java source code that deserializes the JSON string into an object and operates on the object, and verify whether there is an injection vulnerability; and determine whether there is a fastjson deserialization vulnerability, if so, traverse the called functions to find the call chain; the result output module 40 is used to output the call chain results of the fastjson deserialization vulnerability.

[0043] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the device embodiments, equipment embodiments, and storage medium embodiments, since they are basically similar to the method embodiments, the descriptions are relatively simple, and relevant parts can be referred to the descriptions of the method embodiments.

[0044] Furthermore, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0045] The foregoing description illustrates and describes preferred embodiments of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the inventive concept by means of the foregoing teachings or techniques or knowledge in related fields. Any modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A method for mining call chains to exploit fastjson deserialization vulnerabilities, characterized in that... Includes the following steps: S1. Configure the Webhook for the project code repository. When the project code repository is updated, the updated project information will be automatically pushed to the specified Webhook URL. The project information must include at least the URL address of the project code. S2. Upon receiving updated project information, identify the URL address of the project code and store the project's Java source code through the project code repository interface or by cloning. S3. Parse the Java source code into an abstract syntax tree, and then convert the abstract syntax tree into a Python trie; S4. Traverse the Python trie and check if the Java source code references or uses the Fastjson library and if a vulnerable version of Fastjson exists. If so, proceed to step S5. S5. Traverse the Python trie to check if there are any parsing vulnerabilities in the JSON string. If so, proceed to step S6. S6. Traverse the Java source code to check if there is a situation where a JSON string is deserialized into an object and the object is manipulated, and verify if there is an injection vulnerability. If so, proceed to step S7. S7. Determine if a fastjson deserialization vulnerability exists. If so, traverse the called functions to find the call chain and output the call chain result containing the fastjson deserialization vulnerability.

2. The fastjson deserialization vulnerability call chain mining method according to claim 1, characterized in that: The project details in step S1 also include the project ID and the project name.

3. The fastjson deserialization vulnerability call chain mining method according to claim 1, characterized in that: Step S3 involves parsing the Java source code into an abstract syntax tree, which specifically includes the following steps: Perform syntax analysis on Java source code, breaking it down into a series of tokens; The syntax is analyzed again, and a series of tokens are combined into an abstract syntax tree.

4. The fastjson deserialization vulnerability call chain mining method according to claim 3, characterized in that: Step S3 involves converting the abstract syntax tree into a Python trie, which specifically includes the following steps: Obtain the AST node of the abstract syntax tree and use it as a parameter to determine the type of the AST node; If the AST node is an object of type javalang.ast.Node, then create an empty dictionary, traverse all the attributes of the AST node, use the attribute name as the key of the dictionary, use the attribute value as the return value of the recursive call as the value of the dictionary, and finally return the dictionary. If the AST node is a list type object, then create an empty list, iterate through each element in the list, add the return value of each element after the recursive call to the list, and finally return the list; If the AST node is of another type, then return the node directly.

5. The fastjson deserialization vulnerability call chain mining method according to claim 1, characterized in that: Step S4 Specifically, the following steps are included: S40. Traverse all import statements in the Python trie and search for import statements that start with "com.alibaba.fastjson". If so, mark them as True. S41. Traverse all classes and methods in the Python trie to find code that uses the Fastjson library. Specifically, traverse the statement list of each method and check if any statement contains the string "com.alibaba.fastjson". If so, mark it as True. S42. Determine the version of "com.alibaba.fastjson". If the version is less than 1.2.80, mark it as True. The result indicates that the Java source code references or uses the Fastjson library and that a vulnerable version of Fastjson exists. Then proceed to step S5.

6. The fastjson deserialization vulnerability call chain mining method according to claim 1, characterized in that: Step S5 specifically includes the following steps: S50. Traverse the Python trie and check if there is a statement containing the string "JSON.parse". If so, extract the JSON string from it. S51. Detect whether the JSON string has a parsing vulnerability. Specifically, check whether the JSON string starts or ends with a double quote. If it does, the JSON string does not have a parsing vulnerability. If not, the JSON string has a parsing vulnerability. Proceed to step S6.

7. The fastjson deserialization vulnerability call chain mining method according to claim 1, characterized in that: Step S6 specifically includes the following steps: S60. Traverse all type declarations in the Java source code and check if any of their fields begin with the keyword "private"; if so, add the name of that field to a list. S61. Iterate through all JSON strings and check if they are contained in any of the class names in the list; if so, proceed to step S7.

8. The fastjson deserialization vulnerability call chain mining method according to claim 1, characterized in that: Step S7 specifically includes the following steps: S70. Pass the Python trie as a parameter, traverse all function calls in the Java source code, and determine whether it is a Fastjson JSON parsing call; if so, recursively traverse the code inside the parsing call and execute step S71. S71. Check if there are still Fastjson JSON parsing calls. If so, return to step S70 until a function or location without Fastjson remote code execution vulnerability is detected. Then output the call chain result with Fastjson deserialization vulnerability. The output of the call chain result containing the Fastjson deserialization vulnerability is as follows: the call chain result containing the Fastjson deserialization vulnerability and the URL address of the project code are saved to the database, and then the address of the project and the call chain containing the Fastjson deserialization vulnerability are retrieved from the database through the Python Flask interface development framework and returned.

9. The fastjson deserialization vulnerability call chain mining method according to claim 8, characterized in that: The call chain is maintained through a call chain list. During recursive traversal, the call chain list is passed to the next level until the traversal ends; at the end of each traversal, the call chain list is displayed.

10. A Fastjson deserialization vulnerability call chain mining system, characterized in that, include: The project code retrieval module is used to configure the Webhook of the code repository. When the project code repository is updated, the updated project information is automatically pushed to the specified Webhook URL. The project information includes at least the URL address of the project code. And the URL address used to identify the project code when updated project information is received, and to store the project's Java source code through the project code repository interface or cloning method; The project code parsing module is used to parse Java source code into an abstract syntax tree, and then convert the abstract syntax tree into a Python trie. The fastjson deserialization vulnerability call chain traversal module is used to traverse the Python trie to detect whether the Java source code references or uses the Fastjson library and whether a vulnerable version of Fastjson exists. Traverse the Python trie to check for parsing vulnerabilities in JSON strings; traverse the Java source code to check for instances where JSON strings are deserialized into objects and manipulated, and verify for injection vulnerabilities. And determine if there is a Fastjson deserialization vulnerability; if so, traverse the called functions to find the call chain. The output module is used to output the call chain results that contain Fastjson deserialization vulnerabilities.

Images