Opening the JAR: The Hitchhiker's Guide to JAR File Dependencies - Daniel Haim Breger
Channel: The Linux Foundation
Date: 2023-10-04

Opening the JAR: The Hitchhiker's Guide to JAR File Dependencies - Daniel Haim Breger, Palo Alto Networks

When looking to find vulnerabilities to exploit in a java program, a natural starting point is to look at its dependencies. Unfortunately, the way dependencies are managed in jar files is far from straightforward and in many cases the information needed to understand it is kept in 20 year old documentation and various blog posts focusing on a specific part of the mechanism. Over the years, multiple solutions have been created to run JAR files and manage their dependencies, and each of them tried to fit within the existing structure of the JAR file. This leads to situations where complex file structures are created, and depending on how the JAR file is run, it’ll be interpreted differently. There are many ways to include dependencies and each method includes many specific behaviors, caveats, and surprising details. Additionally, even though the existing documentation directs developers to use best practices, many real world JAR files go outside the documented realm. In this talk I will present the structure of JAR files and common ways they can include dependencies, from the simple to the cursed, and the important things to watch out for when looking for them. We will cover several incorrect implementations of jar dependencies, edge cases in their processing, and other oddities.