A state deviation analysis-based access control vulnerability detection method and system

Abstract

The application discloses a kind of access control vulnerability detection method and system based on state deviation analysis, which comprises: the source code of web application is as input, the expected behavior logic contained in the site map and code is extracted by static analysis, then the generated site map is as the guide of dynamic analysis, and the login credentials of multiple roles and multiple users are input, to obtain HTTP request and response under different login states;Web application is modeled using finite state machine FSM, and the discovery of access control vulnerabilities is formalized as the difference between the expected FSM behavior model and the actual FSM behavior model, identifying access control vulnerabilities and generating a vulnerability report.The present application can detect complex logic that is difficult to find by static analysis, and the targeted functional testing also greatly improves the detection efficiency, enabling full path coverage.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to an access control vulnerability detection method and system based on state deviation analysis. BACKGROUND

[0002] With the economic growth of society, the Internet is developing at a rapid pace, penetrating into every field of social life, and has become an essential element of modern society. As the most important application form of the Internet, Web technology has been widely popularized and used in important fields such as education, transportation and finance. With the development of the Internet, Web technology has penetrated into all aspects of people's daily life. Shopping websites, online banks, social platforms and other Web applications are emerging, which highlights the vital role of Web technology in people's lives.

[0003] While bringing convenience to people's daily life, the number of attacks on Web applications is rising rapidly every year. In the research on Web vulnerabilities, researchers initially focused on injection vulnerabilities because injection vulnerabilities have a unified logic, that is, the user's input reaches a risky processing function after insufficient filtering. All injection vulnerabilities have this pattern, so identifying this data flow transmission pattern can help discover such vulnerabilities. Web application logic vulnerabilities are related to the functions of Web applications, and there is no fixed discovery pattern, so it is extremely challenging to identify and handle these vulnerabilities. Access control vulnerabilities in logic vulnerabilities have risen from fifth to first in OWASP 2021Top10, and 94% of the applications tested have access control vulnerabilities.

[0004] Access control vulnerabilities are formed due to the difference between the expected access control policy and the policy actually implemented in the network application. Considering that the implementation of the application usually does not have a clear access control policy, deriving the expected access control policy becomes a key step in identifying access control vulnerabilities. Some techniques have been proposed in existing works to automatically extract access control policies, but existing methods are limited by the coarse granularity of establishing access control models, handling complex relationships between data entities, handling source code languages and specific platform requirements, and cannot model complex data relationships across multiple program files and determine the resulting access control problems.

[0005] In summary, the traditional single static method only obtains the logic in the code, detects the conflict in the logic, and defines the conflict as an access control vulnerability, and the detection rate of the access control vulnerability is extremely low, only a part of the simple access control vulnerability can be detected, it is difficult to detect the access control vulnerability with complex logic in the real environment, and the dependence on the code is extremely high, and customized analysis needs to be made for different languages, different architectures and different platforms. And the black box test can only test the function obtained through the page, and the path coverage rate is difficult to meet the expectation, and a large amount of inefficient fuzzy test will be made. SUMMARY

[0006] The present application aims at the problems that the existing access control vulnerability identification method is limited by the problems of coarse granularity of establishing an access control model, complex relationship between data entities, requirement of source code language and specific platform, and cannot model the complex data relationship across multiple program files and determine the access control problems caused thereby, and proposes an access control vulnerability detection method and system based on state deviation analysis, which converts the access control vulnerability detection problem into the difference between the expected behavior logic extracted from the code and the actual behavior logic of the real access, so that the limitations of model granularity and data relationship complexity on vulnerability detection are greatly reduced, and compared with the traditional black box method, the detection efficiency is greatly improved by combining the white box technology.

[0007] In order to achieve the above purpose, the technical scheme adopted by the present application is as follows:

[0008] The present application proposes an access control vulnerability detection method based on state deviation analysis, which comprises:

[0009] The source code of the Web application is taken as input, the sitemap and the expected behavior logic contained in the code are extracted through static analysis, then the generated sitemap is taken as the guide of dynamic analysis, and the login credentials of multiple roles and multiple users are input to obtain HTTP requests and HTTP responses under different login states.

[0010] The Web application is modeled by using a finite state machine FSM, the discovery of the access control vulnerability is formalized as the difference between the expected FSM behavior model and the actual FSM behavior model, the access control vulnerability is identified and a vulnerability report is generated, which comprises: the access control information in the expected behavior logic exhibited in the source code of the Web application is analyzed by using static analysis, the expected FSM behavior model is established, and the difference between the actual FSM behavior model established by the access control information contained in the HTTP request and the HTTP response in the actual running process of the Web application during dynamic analysis is found.

[0011] Further, the finite state machine FSM is (S, s0, sigma, Lambda, A, delta, F), wherein S represents a finite state set, the states are represented as pages of the web application having unique URLs; s0 represents an initial state, i.e. the home page of the web application; sigma represents a finite input set; Lambda represents an output set; A is a triple <R, P, Se>, R represents an access permission level of a user accessing the page, P represents a set of parameters in the HTTP request and corresponding values thereof, and Se represents a set of session variables and corresponding values thereof; delta represents a transition function, which is defined as a mapping from S x sigma x A to S; and F represents a set of final states, i.e. pages where navigation within the web application ends.

[0012] Further, the expected FSM behavior model is constructed in the following manner:

[0013] The source code of the web application is traversed, if there is a routing file capable of obtaining a URL-to-file mapping, the routing file is read, a relationship mapping is constructed, parameters are extracted, functions related to access control within the page are searched, a range of access control function constraints is determined, a constraint relationship between application functions and roles is established, a mapping relationship between page application functions and constraints is generated, if the mapping relationship already exists but the constraints are different, the mapping relationship is marked, the constraints are added to a list, and in this way a constraint relationship list of each functional page is obtained, which is used as a functional node state set, and is represented as an expected access finite state machine behavior model of the web application, i.e. an expected FSM behavior model.

[0014] Further, the actual FSM behavior model is constructed in the following manner:

[0015] HTTP requests and HTTP responses are traversed, a Session state is obtained, if the page has not been accessed before, a new state is created, a request-response mapping is generated, if the page has been accessed before, a stored state is directly obtained, a mapping is established, if the mapping already exists but the Session is different, the Se is added to a Se set of the current mapping, and in this way a state set of each functional node is traversed to construct an actual access finite state machine behavior model of the web application, i.e. an actual FSM behavior model.

[0016] Further, the types of the access control vulnerabilities include: authentication bypass, vertical privilege escalation, and horizontal privilege escalation.

[0017] Further, the detection process of the authentication bypass includes:

[0018] By querying a calling relationship in a page without session detection and access control, an association with a login state is established, and whether an authentication bypass vulnerability exists is analyzed.

[0019] Further, the vertical privilege-escalation detection process comprises:

[0020] Identifying the transitions to the same target state and the role set that can access the state in the expected FSM behavior model and the actual FSM behavior model, extracting the roles that can enter the state from the session variables and storing them in the accessible role list;

[0021] Excluding the role list from the entire role set for the application to obtain the non-accessible role set for the state, and updating the list as the URL of the target state and the role set that cannot access the state;

[0022] The above process is repeated until all privileged pages in the web application are identified;

[0023] After identifying the privileged pages, submitting attack requests to the privileged pages and non-privileged roles, comparing the responses obtained by the attack requests, i.e., the responses obtained by the expected FSM behavior model, with the responses obtained by normal execution, i.e., the responses obtained by the actual FSM behavior model, to analyze whether there is a vertical privilege-escalation vulnerability.

[0024] Further, the horizontal privilege-escalation detection process comprises:

[0025] Determine the transition function that has the same value for any parameter and session variable; submit an attack request to the target state of the transition function; the value of the parameter is different from the value of the session variable; compare the response obtained by the attack request, i.e., the response obtained by the expected FSM behavior model, with the response obtained by normal execution, i.e., the response obtained by the actual FSM behavior model, to determine whether there is a horizontal privilege-escalation vulnerability.

[0026] Another aspect of the present application proposes an access control vulnerability detection system based on state deviation analysis, comprising:

[0027] A site map and behavior logic extraction module for taking the source code of a web application as input, extracting the site map and the expected behavior logic contained in the code through static analysis, then taking the generated site map as a guide for dynamic analysis, and inputting multi-role multi-user login credentials to obtain HTTP requests and HTTP responses under different login states;

[0028] The FSM modeling and vulnerability detection module is used for modeling the web application by using a finite state machine (FSM), formalizing the discovery of the access control vulnerability as a comparison of differences between an expected FSM behavior model and an actual FSM behavior model, identifying the access control vulnerability and generating a vulnerability report; including: using static analysis to analyze the access control information in the expected behavior logic exhibited in the source code of the web application, establishing an expected FSM behavior model, and then finding differences with an actual FSM behavior model established by the access control information contained in the HTTP request and HTTP response in the actual running process of the web application during dynamic analysis.

[0029] Further, the finite state machine FSM is (S, s0, σ, Λ, A, δ, F), where S represents a finite state set, the states are represented as pages of the web application having unique URLs; s0 represents an initial state, i.e., the home page of the web application; σ represents a finite input set; Λ represents an output set; A is a three-tuple <R, P, Se>, R represents the access permission level of the user accessing the page, P represents the set of parameters in the HTTP request and the corresponding values, and Se represents the set of session variables and the corresponding values; δ represents a transition function, which is defined as a mapping from S x σ x A to S; F represents a set of final states, i.e., pages where the navigation within the web application ends.

[0030] Further, the expected FSM behavior model is constructed in the following manner:

[0031] The source code of the web application is traversed, if a routing file can obtain a URL-to-file mapping, the routing file is read, a relationship mapping is constructed, and parameters are extracted; it is determined whether there are functions related to access control within the page, the range of the access control function constraint is determined, a constraint relationship between the application function and the role is established, a mapping relationship between the page application function and the constraint is generated, if the mapping relationship already exists but the constraint is different, the mapping relationship is marked, the constraint is added to the list, and in this way, a constraint relationship list of each functional page is obtained, which is used as a functional node state set, and is represented as an expected access finite state machine behavior model of the web application, i.e., an expected FSM behavior model.

[0032] Further, the actual FSM behavior model is constructed in the following manner:

[0033] Iterate through HTTP requests and responses to obtain Session states. If the page has not been accessed before, create a new state and generate a request-response mapping. If the page has been accessed before, directly obtain the stored state and establish a mapping. If the mapping already exists but the Session is different, add the Se to the Se set of the current mapping. By traversing the state sets of each functional node, a finite state machine behavior model representing the actual access behavior of the web application is constructed, i.e., the actual FSM behavior model.

[0034] Furthermore, the types of access control vulnerabilities include: authentication bypass, vertical privilege escalation, and horizontal privilege escalation.

[0035] Furthermore, the authentication bypass detection process includes:

[0036] By querying call relationships on pages lacking session detection and access control, an association with login status can be established, thereby analyzing whether authentication bypass vulnerabilities exist.

[0037] Furthermore, the vertical over-weighting detection process includes:

[0038] Identify the transitions to the same target state in the expected FSM behavior model and the actual FSM behavior model, as well as the set of roles that can access that state. Extract the roles that can enter that state from the session variables and store them in the list of accessible roles.

[0039] The list of roles is excluded from the total set of roles used for the application, resulting in a set of roles that should not be accessed in this state. The list is then updated with the URL of the target state and the set of roles that cannot access this state.

[0040] The above process is repeated until all privileged pages in the web application have been identified;

[0041] After identifying privileged pages, attack requests are submitted to both privileged pages and non-privileged roles. The responses to the attack requests, i.e., the responses expected by the FSM behavior model, are compared with the responses obtained during normal execution, i.e., the responses obtained by the actual FSM behavior model, in order to analyze whether a vertical privilege escalation vulnerability exists.

[0042] Furthermore, the horizontal overreach detection process includes:

[0043] Identify a transition function with any parameters and session variables having the same value; submit an attack request to the target state of the transition function: the value of the parameter is different from the value of the session variable; compare the response obtained from the attack request, i.e. the response obtained from the expected FSM behavior model, with the response obtained during normal execution, i.e. the response obtained from the actual FSM behavior model, to determine whether a horizontal privilege escalation vulnerability exists.

[0044] Compared with the prior art, the present application has the beneficial effects:

[0045] The present application adopts state deviation analysis technology combined with white box technology, extracts parameters and access control class functions from the code through static analysis, reduces the degree of dependence on the code, and converts the detection problem of access control vulnerabilities into the problem of detecting the difference between the expected behavior logic of the application and the actual behavior logic of the real access in the code, which simplifies the problem difficulty and greatly improves the detection efficiency, can detect complex logic that is difficult to find by static analysis, and the directional function test also greatly improves the detection efficiency and can realize full path coverage. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 A flowchart of an access control vulnerability detection method based on state deviation analysis for an embodiment of the present application;

[0047] Figure 2 An access control vulnerability detection method based on state deviation analysis for an embodiment of the present application and the detection efficiency of DetLogic are compared. DETAILED DESCRIPTION

[0048] The present application will be further explained and described below in conjunction with the drawings and specific embodiments:

[0049] As shown in Figure 1 An access control vulnerability detection method based on state deviation analysis, comprising:

[0050] Taking the source code of the Web application as input, the expected behavior logic contained in the site map and the code is extracted through static analysis, and then the generated site map is used as the guide for dynamic analysis, and the login credentials of multiple roles and multiple users are input to obtain HTTP requests and HTTP responses under different login states;

[0051] The Web application is modeled using a finite state machine FSM, and the discovery of access control vulnerabilities is formalized as a comparison of the difference between the expected FSM behavior model and the actual FSM behavior model, and the access control vulnerabilities are identified and a vulnerability report is generated; including: using static analysis to analyze the access control information in the expected behavior logic exhibited in the source code of the Web application, establishing an expected FSM behavior model, and then finding the difference points with the actual FSM behavior model established by the access control information contained in the HTTP request and HTTP response in the actual running process of the Web application during dynamic analysis.

[0052] Specifically, the patent mainly uses finite automata FSM to model the logic of the web application, formalizes the access control vulnerability as the difference between the expected FSM behavior model and the actual FSM behavior model, thereby realizing the mining of access control vulnerabilities. The expected FSM behavior model is established by scanning the code through static analysis, identifying and logically judging the access control function, and establishing the expected behavior model of the web application. And generate a site map through static scanning, provide for dynamic analysis. The actual FSM behavior model is obtained by using the site map provided by static analysis as a path selection sentence through dynamic analysis, using a crawler to crawl the functions of the web application, and obtaining different state HTTP request response states by using different role user login credentials, and establishing the actual behavior model of the web application. The difference between the finite state machine is analyzed to realize the detection of access control vulnerabilities.

[0053] Further, in order to realize the identification of logical vulnerabilities, a FSM model (S, s0, σ, Λ, A, δ, F) is used to model the web application. Specifically, the information required to build the finite state machine model is obtained by extracting the execution traces generated by the interaction between the crawler or manual access and the server through the proxy service in the dynamic analysis module.

[0054] The finite state machine FSM is (S, s0, σ, Λ, A, δ, F), wherein S represents a finite state set, the states are represented as pages of the web application having unique URLs; s0 represents the initial state, that is, the home page of the web application, from which navigation begins; σ represents a finite input set; Λ represents an output set; A is a three-tuple <R, P, Se>, R represents the access permission level of the user accessing the page, P represents the set of parameters in the HTTP request and their corresponding values, and Se represents the set of session variables and their corresponding values; δ represents the transition function, which is defined as a mapping from S x σ x A to S; F represents the set of final states, that is, the pages where navigation ends within the web application.

[0055] Specifically, the expected behavior logic is extracted from the source code by algorithm 1 to establish the expected FSM behavior model of the web application, and then the functions of the web application are dynamically analyzed by a crawler.

[0056]

[0057]

[0058] Specifically, the expected FSM behavior model is constructed as follows:

[0059] Traverse the source code of the web application, if there is a route file that can get the URL to file mapping, read the route file, build the relationship mapping, extract the parameters; find out if there is a function related to access control in the page, determine the scope of access control function constraints, establish the constraint relationship between application functions and roles, generate the mapping relationship of page application functions and constraints, if the mapping relationship already exists but the constraints are different, mark the mapping relationship, add the constraints to the list, get the constraint relationship list of each function page, as the function node state set, represented as the expected access finite state machine behavior model of the web application, that is, the expected FSM behavior model.

[0060] When the crawler crawls, input various login state user login credentials to it, so that different responses of multiple states accessing the same page can be obtained to identify the following types of web pages:

[0061] 1. Only pages that can be accessed after login.

[0062] 2. Pages that can only be accessed by certain roles (i.e. privileged pages).

[0063] 3. User customized pages that other users of the same role cannot access.

[0064] Specifically, the actual FSM behavior model of the web application is constructed according to Algorithm 2.

[0065]

[0066]

[0067] Further, the actual FSM behavior model is constructed in the following manner:

[0068] Traverse the HTTP request and HTTP response to obtain the Session state, if the page has not been accessed before, create a new state, generate the request response mapping, if the page has been accessed before, directly obtain the stored state, establish the mapping, if the mapping already exists but the Session is different, add the Se to the Se set of the current mapping, by traversing the state set of each function node, to construct the actual access finite state machine behavior model of the web application, that is, the actual FSM behavior model.

[0069] After constructing the actual FSM behavior model of the web application according to Algorithm 2 through HTTP request and HTTP response, the following access control vulnerability types are identified by analyzing the differences:

[0070] 1. Authentication bypass:

[0071] The focus of this attack is to identify a page that needs to be accessed by a privileged user but fails to impose access checks in the source code. Such a page is accessed as a third party / non-privileged user by submitting an HTTP request for the page without submitting valid credentials. In other words, a page in a web application is accessed by any user without the need to log in, which is known as an authentication bypass attack. This vulnerability has the exact same behavior in both FSM models, but it is vulnerable because there is no constraint in the code that identifies which pages should have access control, but it is possible to analyze whether there is an authentication bypass vulnerability by establishing a correlation between the login state and the calling relationship in the pages that do not have session detection and access control.

[0072] 2. Vertical privilege escalation:

[0073] A privileged page is accessed by submitting an HTTP request for the page with a valid username in the parameters but without setting the appropriate session variable for the privilege. The first step is to identify the privileged pages and the roles that can access the corresponding pages. To achieve this goal, the transitions in both FSM models that lead to the same target state and the set of roles that can access the state are identified. The roles that can enter the state are extracted from the session variable and stored in a list of accessible roles. The list is excluded from the set of all roles used in the application, and the set of roles that should not access the state is obtained. The list is updated with the URL of the target state and the set of roles that cannot access the state. This process is repeated until all privileged pages in the application are identified. After the privileged pages are identified, attack requests are submitted to those privileged pages and non-privileged roles. The responses obtained from these attack requests (responses obtained from the expected FSM behavior model) are compared with the responses obtained from the normal execution (responses obtained from the actual FSM behavior model) to analyze whether there is a vertical privilege escalation vulnerability.

[0074] 3. Horizontal privilege escalation:

[0075] A page belonging to a user customization that can be accessed by other users of the same role because only a role check is performed. The first step is to identify the transition functions that have the same values for any parameters and session variables. The second step is to submit requests to the target states of these transition functions with different values for the parameters and session variables. The responses obtained from these attack requests (responses obtained from the expected FSM behavior model) are compared with the responses obtained from the normal execution (responses obtained from the actual FSM behavior model) to determine whether there is a horizontal privilege escalation vulnerability.

[0076] By using the above analysis logic as the main decision-making strategy, access control vulnerabilities are identified and a vulnerability report is generated.

[0077] To verify the effect of the present application, the following experiment was performed:

[0078] For the convenience of expression, the method of the present application is simply referred to as ACVD.

[0079] The prototype tool ACVD is used to detect access control vulnerabilities in five selected web applications (SCARF, Wackopicko, Bloggit (https: / / github.com / l3iodeez / bloggit), OpenIT, and Events Lister (full name: Basic-PHP-Events-Lister)). The results are shown in Table 1. In order to comprehensively compare the performance gap between static analysis, pure black box testing (specifically DetLogic), and the ACVD of the present application, there are differences between the two prototype tools (static analysis and pure black box testing) in the selected web applications. Since the code is not open source, the performance of the prototype tools in projects not covered in this embodiment cannot be obtained, and is temporarily left blank for reference.

[0080] The experimental results are shown in Table 1. In performance testing of selected web applications, it is found that in the detection of access control vulnerabilities, ACVD can basically achieve full coverage of access control vulnerabilities in selected applications, and can achieve high recall of access control vulnerabilities. After manual reproduction and audit, it is found that there may be some false positives. Compared with the experimental data of DetLogic, the detection efficiency of ACVD for access control vulnerabilities is higher than that of DetLogic, and is significantly better than the detection results of static analysis.

[0081] Table 1. Vulnerability detection results and comparison

[0082]

[0083] As shown in Table 1, the detection efficiency of the prototype tool ACVD proposed in this patent for access control vulnerabilities is significantly higher than that of the black box testing tool DetLogic. However, since DetLogic is not open source, it cannot be compared realistically. However, the dynamic analysis tool in ACVD is an independent module that can be used as a black box test without the results of static analysis. Its performance should tend to be similar to that of DetLogic. In this case, pure black box testing is used to compare with ACVD testing, and the results are shown in Table 2. Figure 2

[0084] Since ACVD first uses static analysis method to obtain path information, it can know the total number of paths and achieve a coverage rate close to 100%. When using pure black box testing, it is difficult to find all paths, and only when no new paths are found within a set time, it is considered that the detection is complete. As shown in Table 2, ACVD is much more efficient than DetLogic using pure black box method, with an efficiency improvement of about 3 times. Figure 2 ​​

[0085] In summary, the patent proposes a state deviation analysis technology and uses it in the detection of access control vulnerabilities, which utilizes the difference between expected logic and actual execution logic, combines the advantages of black box and white box methods, and realizes efficient detection of access control vulnerabilities.

[0086] On the basis of the above-mentioned embodiments, another aspect of the present application proposes an access control vulnerability detection system based on state deviation analysis, comprising:

[0087] The site map and behavior logic extraction module is used to take the source code of the Web application as input, extract the site map and the expected behavior logic contained in the code through static analysis, and then generate the site map as a guide for dynamic analysis and input the login credentials of multiple roles and users to obtain HTTP requests and HTTP responses under different login states.

[0088] The FSM modeling and vulnerability detection module is used to model the Web application using a finite state machine FSM, formalize the discovery of access control vulnerabilities as a comparison of the difference between the expected FSM behavior model and the actual FSM behavior model, identify access control vulnerabilities and generate a vulnerability report; including: using static analysis to analyze the access control information in the expected behavior logic exhibited in the source code of the Web application, establishing an expected FSM behavior model, and then finding the difference points with the actual FSM behavior model established by the access control information contained in the HTTP request and HTTP response in the actual running process of the Web application during dynamic analysis.

[0089] Further, the finite state machine FSM is (S, s0, sigma, Lambda, A, delta, F), wherein S represents a finite state set, these states are represented as pages of the Web application having unique URLs; s0 represents the initial state, i.e. the home page of the Web application; sigma represents a finite input set; Lambda represents an output set; A is a three-tuple <R, P, Se>, R represents the access permission level of the user accessing the page, P represents the set of parameters in the HTTP request and their corresponding values, and Se represents the set of session variables and their corresponding values; delta represents the transition function, which is defined as a mapping from S x sigma x A to S; F represents the set of final states, i.e. the pages where the navigation in the Web application ends.

[0090] Further, the expected FSM behavior model is constructed in the following manner:

[0091] Traverse the source code of the Web application, if there is a routing file to obtain the mapping of URL to file, read the routing file, build the relationship mapping, extract the parameters; find out if there is a function related to access control in the page, determine the scope of the access control function constraint, establish the constraint relationship between application function and role, generate the mapping relationship of page application function and constraint, if the mapping relationship already exists but the constraint is different, mark the mapping relationship, add the constraint to the list, in this way obtain the constraint relationship list of each function page, as the function node state set, expressed as the expected access finite state machine behavior model of the Web application, that is, the expected FSM behavior model.

[0092] Further, the actual FSM behavior model is constructed in the following way:

[0093] Traverse the HTTP request and HTTP response, obtain the Session state, if the page has not been accessed before, create a new state, generate the mapping of request response, if the page has been accessed before, directly obtain the stored state, establish the mapping, if the mapping already exists but the Session is different, add the Se to the Se set of the current mapping, through traversing the state set of each function node, in this way build the actual access finite state machine behavior model of the Web application, that is, the actual FSM behavior model.

[0094] Further, the type of the access control vulnerability includes: authentication bypass, vertical privilege escalation, horizontal privilege escalation.

[0095] Further, the detection process of the authentication bypass includes:

[0096] By querying the calling relationship in the page without session detection and access control, the association with the login state is established, so that whether there is an authentication bypass vulnerability is analyzed.

[0097] Further, the detection process of the vertical privilege escalation includes:

[0098] Identify the transitions to the same target state in the expected FSM behavior model and the actual FSM behavior model and the role set that can access the state, extract the roles that can enter the state from the session variable, and store them in the accessible role list;

[0099] Exclude the role list from the entire role set for the application to obtain the non-accessible role set of the state, the list is updated to the URL of the target state and the role set that cannot access the state;

[0100] The above process is repeated until all privileged pages in the Web application are identified;

[0101] After the privileged page is identified, an attack request is submitted to the privileged page and the non-privileged role, the response obtained by the attack request, i.e. the response obtained by the expected FSM behavior model, is compared with the response obtained in normal execution, i.e. the response obtained by the actual FSM behavior model, so as to analyze whether there is a vertical privilege-escalation vulnerability.

[0102] Further, the detection process of the horizontal privilege-escalation includes:

[0103] A transition function that determines that any parameter and session variable have the same value is determined, an attack request is submitted to the target state of the transition function, the value of the parameter is different from the value of the session variable, the response obtained by the attack request, i.e. the response obtained by the expected FSM behavior model, is compared with the response obtained in normal execution, i.e. the response obtained by the actual FSM behavior model, so as to determine whether there is a horizontal privilege-escalation vulnerability.

[0104] In summary, the state deviation analysis technology is combined with the white-box technology, the parameter and the access control class function are extracted from the code in static analysis, the dependence on the code is reduced, the detection problem of the access control vulnerability is converted into the difference problem of the expected behavior logic and the actual behavior logic of the real access, the problem difficulty is simplified, the detection efficiency is greatly improved, the complex logic that is difficult to be found by the static analysis can be detected, the detection efficiency is greatly improved by the directional function test, and full path coverage can be realized.

[0105] The above only shows the preferred embodiments of the present application, and it should be noted that, for those skilled in the art, some improvements and refinements can be made without departing from the principles of the present application, and these improvements and refinements should also be considered as the protection scope of the present application.

Claims

1. A method for detecting access control vulnerabilities based on state deviation analysis, characterized in that, The application comprises the following steps: Taking the source code of the web application as input, extracting the sitemap and expected behavior logic contained in the code through static analysis, then taking the generated sitemap as guidance for dynamic analysis, and inputting the login credentials of multiple roles and users to obtain HTTP requests and HTTP responses under different login states; Modeling the web application using a finite state machine (FSM), and formalizing the discovery of access control vulnerabilities as a comparison between the expected FSM behavior model and the actual FSM behavior model, identifying access control vulnerabilities and generating a vulnerability report; including: using static analysis to analyze the access control information in the expected behavior logic exhibited in the source code of the web application, establishing an expected FSM behavior model, and then finding differences with the actual FSM behavior model established by the access control information contained in the HTTP requests and HTTP responses during the actual running of the web application during dynamic analysis; The finite state machine FSM is where S denotes a finite set of states, represented as pages of the web application having a unique URL; denotes the initial state, i.e. the home page of the web application; denotes a finite set of inputs; denotes a set of outputs; A is a triple <R, P, Se>, R denotes the access level of the user accessing the page, P denotes the set of parameters in the HTTP request and their corresponding values, Se denotes the set of session variables and their corresponding values; denotes the transition function, defined as a mapping from to S; F denotes the set of final states, i.e. the pages where the navigation inside the web application ends.

2. The method of claim 1, wherein, The expected FSM behavior model is constructed as follows: Traverse the source code of the web application, if there is a routing file that can obtain the mapping from URL to file, read the routing file, construct the relationship mapping, and extract the parameters; find out if there are functions related to access control in the page, determine the scope of access control function constraints, establish the constraint relationship between application functions and roles, generate the mapping relationship of page application functions and constraints, if the mapping relationship already exists but the constraints are different, mark the mapping relationship, add the constraints to the list, and obtain the constraint relationship list of each function page, which is the function node state set, represented as the expected access FSM behavior model of the web application, i.e. the expected FSM behavior model.

3. The method of claim 1, wherein, The actual FSM behavior model is constructed as follows: Traverse the HTTP requests and HTTP responses to obtain the Session state, if the page has not been accessed before, create a new state, generate the mapping of request response, if the page has been accessed before, directly obtain the stored state, establish the mapping, if the mapping already exists but the Session is different, add the Session to the Se set of the current mapping, and construct the actual access FSM behavior model of the web application, i.e. the actual FSM behavior model, by traversing the state set of each function node.

4. The method of claim 1, wherein, The types of access control vulnerabilities include: authentication bypass, vertical privilege escalation, and horizontal privilege escalation.

5. The method of claim 4, wherein, The detection process of the authentication bypass comprises: By querying the call relationship in the page without session detection and access control, the association with the login state is established, and whether there is an authentication bypass vulnerability is analyzed.

6. The method of claim 4, wherein the method further comprises: The detection process of the vertical privilege escalation comprises: Identify the transitions to the same target state in the expected FSM behavior model and the actual FSM behavior model, and the role set that can access the state, extract the roles that can enter the state from the session variable, and store them in the accessible role list; The role list is excluded from the entire role set for the application to obtain a set of roles that should not access the state, and the list is updated to the URL of the target state and the set of roles that cannot access the state; The above process is repeated until all privileged pages in the web application are identified; After identifying the privileged pages, an attack request is submitted to the privileged pages and non-privileged roles, and the response obtained by the attack request, i.e., the response obtained by the expected FSM behavior model, is compared with the response obtained during normal execution, i.e., the response obtained by the actual FSM behavior model, to analyze whether there is a vertical privilege escalation vulnerability.

7. The method of claim 4, wherein the method further comprises: The detection process of the horizontal privilege escalation includes: Determining the transition function that any parameter and session variable have the same value; submitting an attack request to the target state of the transition function; the value of the parameter is different from the value of the session variable; comparing the response obtained by the attack request, i.e., the response obtained by the expected FSM behavior model, with the response obtained during normal execution, i.e., the response obtained by the actual FSM behavior model, to determine whether there is a horizontal privilege escalation vulnerability.

8. A state deviation analysis based access control vulnerability detection system, characterized in that, It includes: A site map and behavior logic extraction module for taking the source code of the web application as input, extracting the site map and the expected behavior logic contained in the code through static analysis, then taking the generated site map as a guide for dynamic analysis, and inputting the login credentials of multiple roles and users to obtain HTTP requests and HTTP responses under different login states; An FSM modeling and vulnerability detection module for modeling the web application using a finite state machine FSM, formalizing the discovery of access control vulnerabilities as a comparison between the expected FSM behavior model and the actual FSM behavior model, identifying access control vulnerabilities and generating a vulnerability report; including: using static analysis to analyze the access control information in the expected behavior logic exhibited in the source code of the web application, establishing an expected FSM behavior model, and then finding differences with an actual FSM behavior model established from access control information contained in HTTP requests and HTTP responses during actual operation of the web application during dynamic analysis. The finite state machine FSM is where S denotes a finite set of states, represented as pages of the web application having a unique URL; denotes the initial state, i.e. the home page of the web application; denotes a finite set of inputs; denotes a set of outputs; A is a triple <R, P, Se>, R denotes the access level of the user accessing the page, P denotes the set of parameters in the HTTP request and their corresponding values, Se denotes the set of session variables and their corresponding values; denotes the transition function, defined as a mapping from to S; F denotes the set of final states, i.e. the pages where the navigation inside the web application ends.

Images