I would like to know a somewhat general approach for white box vulnerability scanning, mainly focused around Java deserialization code bugs that could lead to RCEs (Remote Code Execution following deserialization).

So far, my current strategy is :

  1. grep on all occurrences of JSON.parseObject(.*); calls.
  2. Verify if input is user controlled or API-controlled.
  3. Test inputs from step 2, and confirm exploitation using a crafted payload.

I'd like my strategy to cover vulnerability such as these, for instance: https://snyk.io/vuln/maven%3Acom.alibaba%3Afastjson


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.