The meta question here is that I'm trying to understand the risks to multitenant java applications from gadget chains.
For example, we're all familiar with the deserialization gadget that allows the creation of arbitrary java objects which can lead to RCE.
However, let's say your json deserializaer (or whatever) is securely configured. Is it possible to create gadget chains which re-configure jackson at runtime to be insecurely configured?
More generally, is it reasonably possible to take any specific vulnerability which has been patched but develop a gadget chain to enable it?
Eg, let's say you have a vulnerability X -> leads to Y (say, RCE).
If you could find a chain of gadgets that lead to X (say X1 -> X2 -> X) than you therefore have X1 -> X2 -> X -> Y
And for fun, let's say X2 isn't available, is it reasonable to try to build a chain that does something like XA2 -> XB2 -> XC2 -> X2
And therefore your path would be X1 -> XA2 -> XB2 -> XC2 -> X2 -> X -> Y?
Is this a reasonable way to look at this problem?
The reason I ask is that we build systems where we think we are safe because X isn't immediately a risk. Or even because X1 -> X2 -> X are all patched properly, when in fact if it's possible to decompose any vulnerability into a chain of gadgets, than we are always at risk and therefore most of our security will become the difficulty in getting past security boundaries (escaping a VM, a container, etc).
Given the number of statics in java and java 3rd party libraries, it seems to me that it could be vulnerable to a very large class of gadget chains. In other words, you don't have to craft an attack in just one request, but can do it via a series of requests.
Is this analysis correct?