基于Java Web的反序列化信息安全漏洞挖掘研究  

Research on Security Vulnerability Mining of Deserialization Information Based on Java Web

作　　者：张晨 ZHANG Chen(Xiamen Institute of Software Technology,Xiamen,Fujian 361024,China)

机构地区：[1]厦门软件职业技术学院,福建厦门361024

出　　处：《成都航空职业技术学院学报》2022年第3期50-53,共4页Journal of Chengdu Aeronautic Polytechnic

摘　　要：信息安全已成为国家安全的关键环节,强化信息安全、保护用户数据安全的重要性不言而喻。由于开发语言和程序设计的缺陷以及相关组件存在风险,Web应用中的信息安全漏洞问题时有发生,使得信息安全以及用户隐私和数据安全遭受到严重的威胁。随着Web技术和Java语言的发展愈加成熟,JavaWeb的使用也越来越广泛,针对JavaWeb的网络攻击手段也变得层出不穷。文章分析了JavaWeb反序列化漏洞的基本成因,从漏洞挖掘的角度出发,分析了漏洞利用链的重要节点,并构造复现了漏洞挖掘和利用的过程,对于如何快速、有效检测出JavaWeb反序列化漏洞,保障Web信息安全具有重要参考价值与意义。Information security has become a key link of national security.The importance of strengthening information security and protecting user data security is self-evident.Due to the defects of development language and program design and the risks of related components,information security vulnerabilities in web applications occur from time to time,seriously threatening information security,user privacy and data security.As the development of web technology and Java language becomes more and more mature,Java Web is more and more widely used,and the network attack methods against Java Web are also updating.This paper explores the basic causes of Java Web deserialization vulnerability,analyzes the important nodes of vulnerability utilization chain from the perspective of vulnerability mining,and constructs and replicates the process of vulnerability mining and utilization,which has important reference value and significance for how to quickly and effectively detect Java Web deserialization vulnerability and ensure web information security.

关 键 词：信息安全 反序列化 Java Web技术 漏洞分析 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]