Suppose you have vulnerable library, vuln-lib.jar, that you then import into your source code but never actually use:

#My imports
import com.vuln.lib.*

#My code ..

And you go onto to deploy this application to a server. Is it possible to exploit a known vulnerability in this library even if your code does not use any of the classes the library provides as part of the source code? And if so, how would that happen?

  • Without actually calling any vulnerable functions, there can be no exploiting of the vulnerable functions.... You would have to watch out for cases where code can be injected that then calls those functions in order to exploit them. – schroeder Jul 16 '19 at 20:22

Yes, this can be done under the right circumstances via deserialization.

  1. Your jar file must have a serializable class which can be used in a gadget chain
  2. Your jar file must be on the classpath
  3. An attacker must be able to provide data that your application deserializes

The attacker provides that data, referencing the class in your jar file in the serialized stream of data.

There are lots of articles and videos available on deserialization and why it's an issue. You might find https://github.com/trendmicro/SecureCodingDojo/ useful as well.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.