  Java (de)serialization is prone to causing security-critical vulnerabilities
that attackers can invoke existing methods (gadgets) on the application's
classpath to construct a gadget chain to perform malicious behaviors. Several
techniques have been proposed to statically identify suspicious gadget chains
and dynamically generate injection objects for fuzzing. However, due to their
incomplete support for dynamic program features (e.g., Java runtime
polymorphism) and ineffective injection object generation for fuzzing, the
existing techniques are still far from satisfactory.
  In this paper, we first performed an empirical study to investigate the
characteristics of Java deserialization vulnerabilities based on our manually
collected 86 publicly known gadget chains. The empirical results show that 1)
Java deserialization gadgets are usually exploited by abusing runtime
polymorphism, which enables attackers to reuse serializable overridden methods;
and 2) attackers usually invoke exploitable overridden methods (gadgets) via
dynamic binding to generate injection objects for gadget chain construction.
Based on our empirical findings, we propose a novel gadget chain mining
approach, \emph{GCMiner}, which captures both explicit and implicit method
calls to identify more gadget chains, and adopts an overriding-guided object
generation approach to generate valid injection objects for fuzzing. The
evaluation results show that \emph{GCMiner} significantly outperforms the
state-of-the-art techniques, and discovers 56 unique gadget chains that cannot
be identified by the baseline approaches.
