Fuzzing Java Applications

What Is Java Fuzzing?

Fuzzing is an automated testing technique that can be used to detect bugs and vulnerabilities in Java applications. During fuzz testing, random inputs are fed to the software under test until a crash happens, or the inputs reach a new program state. Afterward, the input that resulted in a crash can be analyzed to fix the discovered bug. If the given inputs did not produce a crash, they are mutated to produce further inputs, that dig deeper into the system under test. Unlike static analysis, fuzzing produces almost no false positives.

4 Reasons Why You Should Fuzz Java Applications

Java is one of the most used programming languages in the industry. It is employed for a wide spectrum of applications ranging from GUIs and databases to servers, web and mobile applications, and IoT software. Due to their complexity and interconnectivity, these applications need to be tested extensively. In this context, automated security testing for Java is becoming more and more popular among developers, as it helps to uncover critical bugs, like SQL-Injections, or Remote Code Executions.

1. Java Is Not Inherently Secure

Due to their runtime error prevention mechanisms, memory-safe languages, such as Java or Go, are mostly immune to memory corruption. In some cases, this has led to the misconception that memory-safe languages are secure by nature. Nonetheless, memory-safe languages have to be tested thoroughly, since there are a variety of vulnerabilities that they are susceptible to. Common security vulnerabilities in memory-safe languages are Cross-Site-Scripting, Denial of Service, Out of Memory Errors, and many more, including devastating OWASP Top 10 bugs.

2. CI/CD Integration

Modern fuzzing platforms such as CI Fuzz can be configured to conduct automated security tests at each pull request. This allows developers to ensure the security of their code without the presence of security experts. By enabling development teams to fix bugs immediately after they were made, continuous fuzzing speeds up software development noticeably. Automated bug finding also has a cultural effect, as it strengthens the awareness of software security within the team.

3. Java Fuzzing Is Available Open Source

Since the release of Jazzer in early 2021, the open-source community has access to a powerful fuzzing tool for JVM-based languages.  Compared to other JVM fuzzing tools, Jazzer offers significantly more executions per second, can find far more bug classes, and provides support for system-level testing, REST web apps, and gRPC web apps.  Jazzer can also be used within Google's open-source fuzzing framework OSS-Fuzz.

4. Getting Started With Java Fuzzing Is Easy

For a long time, fuzzing was a technology with high barriers to entry, as it required expert knowledge to write test harnesses.  Nowadays fuzzing can be fully automated. Thanks to autofuzz, writing test harnesses manually is no longer required, which enables every developer to run a Java fuzz test within a couple of clicks. Autofuzz is currently only available in CI Fuzz for enterprise use, and in Jazzer for open-source use.

Main Benefits of Applying Fuzz Testing for Java Applications

Many security testing specialists consider fuzz testing a best practice for Java security testing. During a Java fuzz test, the fuzz target and its dependencies are instrumented with so-called Java agents. These Java agents ensure that information about code coverage can be reported back to the fuzzer. The fuzzer then uses this information to mutate test inputs in order to reach further parts of the software under test. Through repetition of this process, the fuzzer then improves test inputs rapidly, until they become highly accurate at detecting even highly complex bugs.

Common Java Vulnerabilities That Can Be Found With Java Fuzzing

Fuzz testing is also an effective approach for finding security vulnerabilities in memory-safe languages. With common Java Fuzzers, like Jazzer, it's possible to uncover all kinds of bugs in Java Applications, e.g.:

Data Validation Errors

• Injections (e.g. SQL Injections)
• Exposure of Sensitive Information to an Unauthorized Actor
• XML External Entities (XXE)
• Sensitive Data Exposure
• Generation of Error Message Containing Sensitive Information
• Cross-Site Scripting (XSS) ​

Logic Issues

• Logic issue: bypass security features

Audit/Logging Errors

• Logging of Excessive Data
• Insufficient Logging
• Insufficient Logging & Monitoring
• Broken Authentication
• Broken Access Control

Cookie Issues

• Sensitive Cookie with Improper SameSite Attribute
• Sensitive Cookie Without 'HttpOnly' Flag
• Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Uncaught Exceptions

• Runtime Exceptions
• NullPointerExceptions
• ArrayIndexOutOfBounds Exceptions
• BufferOverflow Exceptions
• NumberFormatExceptions
• ParseException (when reading user data).

Other Issues

• Denial of Service (DoS)
• Infinite Loop
• Security Misconfiguration
• Insecure Deserialization
• Using Components with Known Vulnerabilities

Fuzz Testing for Functional Bugs

Fuzzing can also be used to uncover functional bugs, which is a valuable addition to classical unit testing.  To uncover functional bugs with fuzzing, developers must define invariants, i.e. properties that must be maintained under all circumstances. For example, compressing data, uncompressing the output, and then compressing it again should always result in the same data. With fuzzing, developers can analyze the program state by creating inputs that maximize code coverage and flag those that cause violations of the invariants. This approach is highly effective at finding corner cases that are often missed with manual approaches.