Umeå University's logo

umu.sePublications
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
GadgetBuilder: an overhaul of the greatest Java deserialization exploitation tool
Umeå University, Faculty of Science and Technology, Department of Computing Science.ORCID iD: 0009-0004-2456-895X
Umeå University, Faculty of Science and Technology, Department of Computing Science.ORCID iD: 0000-0002-7679-0796
Umeå University, Faculty of Science and Technology, Department of Computing Science.ORCID iD: 0009-0003-6401-4364
Umeå University, Faculty of Science and Technology, Department of Computing Science.ORCID iD: 0000-0001-7486-0538
Show others and affiliations
2026 (English)In: Secure IT systems: 30th Nordic conference, NordSec 2025, Tartu, Estonia, November 12-13, 2025, proceedings / [ed] Raimundas Matulevičius; Liina Kamm; Mubashar Iqbal, Cham: Springer, 2026, p. 184-203Conference paper, Published paper (Refereed)
Abstract [en]

The Serializable API remains one of the most significant liabilities to Java application security. In particular, it brings a substantial share of vulnerabilities related to insecure deserialization entry points and gadget chains to exploit them. The latter can be attributed in large part to the gadget chain payload generator Ysoserial. With its undeniable value for penetration testing and research, it is regrettable that this tool received its last update in 2021. Not only does Ysoserial lack recent gadget chains, but its rigid architecture makes it hard to reuse or adapt gadgets. Such modifications are, however, crucial to bypass security measures in current Java versions. In this work, we overcome these deficiencies by designing the new payload generator GadgetBuilder. Our tool combines 31 main gadget chains in Ysoserial with 29 chains from other sources. It splits up the gadget chain construction into three gadget chain fragments. This abstraction increases the effective number of gadget chains to 303. Further, by using recent gadgets, 17 of the Ysoserial gadget chains become viable again for recent Java versions (16 and above). It also increases the attack surface against Java deserialization filters. Thereby, our work facilitates a much-needed update to Ysoserial that provides security researchers with a comprehensive overview of deserialization gadget chains.

Place, publisher, year, edition, pages
Cham: Springer, 2026. p. 184-203
Series
Lecture Notes in Computer Science, ISSN 0302-9743, E-ISSN 1611-3349 ; 16325
Keywords [en]
Java, Insecure Deserialization, Gadget Chain, Ysoserial
National Category
Security, Privacy and Cryptography
Identifiers
URN: urn:nbn:se:umu:diva-252323DOI: 10.1007/978-3-032-14782-0_11Scopus ID: 2-s2.0-105036744576ISBN: 978-3-032-14781-3 (print)OAI: oai:DiVA.org:umu-252323DiVA, id: diva2:2054765
Conference
NordSec 2025, The 30th Nordic Conference on Secure IT Systems, Tartu, Estonia, November 12-13, 2025
Funder
Wallenberg AI, Autonomous Systems and Software Program (WASP)Available from: 2026-04-21 Created: 2026-04-21 Last updated: 2026-05-22Bibliographically approved

Open Access in DiVA

The full text will be freely available from 2027-04-01 07:17
Available from 2027-04-01 07:17

Other links

Publisher's full textScopus

Authority records

Kreyssig, BrunoHouy, SabineZhang, HantangRiom, TimothéeBartel, Alexandre

Search in DiVA

By author/editor
Kreyssig, BrunoHouy, SabineZhang, HantangRiom, TimothéeBartel, Alexandre
By organisation
Department of Computing Science
Security, Privacy and Cryptography

Search outside of DiVA

GoogleGoogle Scholar

doi
isbn
urn-nbn

Altmetric score

doi
isbn
urn-nbn
Total: 11 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf