ODDFuzz: Hunting Java Deserialization Gadget Chains via Structure-Aware Directed Greybox Fuzzing
summary
Combines a lightweight static analyzer with structure-aware directed greybox fuzzing to find and validate Java deserialization gadget chains by constructing property-tree instances, serializing them via reflection, and fuzzing seeds guided by control-flow distance and coverage. Static phase uses a simplified points-to SP-graph plus on-demand CHA to tolerate polymorphism; dynamic phase mutates seeds to verify reachability. Evaluation reproduces 20 of 34 candidate chains, generates runnable serialized seeds for 16, and uncovers 6 previously unknown chains (5 assigned CVEs).
AI-written summary · about
chapters (19)
- 0:00ODDFuzz introduction
- 1:10Deserialization gadget chains
- 4:04Why automatic discovery matters
- 5:32Limitations of existing tools
- 8:47Gadget chain challenges
- 9:30ODDFuzz design approach
- 11:39Static analyzer implementation
- 16:43Call graph generation
- 18:55Static analyzer key points
- 20:01Directed greybox fuzzing
- 21:29Seed generation via introspection
- 23:38Property tree handling
- 25:25Seed prioritization feedback
- 26:50Reachability and exploitability
- 27:10Evaluation results
- 28:39Comparison with Gadget Inspector
- 28:59WebLogic gadget chain
- 31:54Limitations and future work
- 33:00Conclusion
related talks
32mDeserialization Vulnerability Remediation with Automated Gadget Chain Discovery
11mIDFuzz: Intelligent Directed Grey-box Fuzzing
35mHow To Find The Next Great Deserialization CVE
53mThree Colours of Fuzzing: Reflections and Open Challenges
45mFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android
25mGoing Beyond Coverage-Guided Fuzzing with Structured Fuzzing
52mStructure aware fuzzing
01h 15mMake your programs more reliable with Fuzzing