Java-Class-Hijack: Software Supply Chain Attack for Java based on Maven Dependency Resolution and Java Classloading
<|reference_start|>Java-Class-Hijack: Software Supply Chain Attack for Java based on Maven Dependency Resolution and Java Classloading: We introduce Java-Class-Hijack, a novel software supply chain attack that enables an attacker to inject malicious code by crafting a class that shadows a legitimate class that is in the dependency tree. We describe the attack, provide a proof-of-concept demonstrating its feasibility, and replicate it in the German Corona-Warn-App server application. The proof-of-concept illustrates how a transitive dependency deep within the dependency tree can hijack a class from a direct dependency and entirely alter its behavior, posing a significant security risk to Java applications. The replication on the Corona-Warn-App demonstrates how compromising a small JSON validation library could result in a complete database takeover.<|reference_end|>
@article{bono2024java-class-hijack:,
    title={Java-Class-Hijack: Software Supply Chain Attack for Java based on Maven
  Dependency Resolution and Java Classloading},
    author={Federico Bono, Frank Reyes, Aman Sharma, Benoit Baudry, Martin
  Monperrus},
    journal={arXiv preprint arXiv:2407.18760},
    year={2024},
    archivePrefix={arXiv},
    eprint={2407.18760},
    primaryClass={cs.CR cs.SE}
}