Improving Java Deserialization Gadget Chain Mining via Overriding-Guided Object Generation

Sicong Cao, Xiaobing Sun, Xiaoxue Wu +7

Java (de)serialization is prone to causing security-critical vulnerabilities that attackers can invoke existing methods (gadgets) on the application's classpath to construct a gadg…