LiteCobra: Enhancing Java Deserialization Vulnerability Detection with Call Graph Pruning

Java deserialization vulnerabilities have become a critical security threat, challenging to detect and even harder to exploit due to deserialization's flexible and customizable nature. Researchers have proposed code property graph methods for comprehensive program analysis and controllability analysis algorithms to filter out irrelevant method calls. However, existing approaches often face limitations in accuracy and efficiency, especially in complex Java deserialization scenarios, leaving a gap in fully addressing this security issue. To address the challenges in detecting Java deserialization gadget chains, this paper proposes LiteCobra - a method that employs edge-cut optimization for rapid call graph construction and uses a controllability analysis algorithm for efficient pruning during Java deserialization gadget chain discovery. Our tests on the ysoserial dataset show that LiteCobra reduces the false positive rate by 67.5% and enhances efficiency by 49.6% compared to state-of-the-art approaches for detecting Java deserialization vulnerabilities. These results indicate that LiteCobra significantly enhances efficiency while maintaining high accuracy in detecting Java deserialization gadget chains.