Method and system for detecting storage type vulnerabilities based on iast technology

Abstract

The application discloses a kind of based on IAST technology detection storage type vulnerability method and system, the method includes: using IAST plug-in tool to plug-in application program to be measured;When entering the data of application program to be measured in stain requires application program to occur data storage operation event, the position information of the data stored in database by stain data is obtained, and the position information is stored to obtain reference data table;When entering the data of application program to be measured in stain requires application program to occur data query operation event, it is judged whether query content is matched with the content recorded in reference data table, if yes, then using marking information to mark the feature of current query content;It is judged whether the query content with marking information appears in output stage or reaches output stage via propagation stage, if yes, then current application program has storage type vulnerability;The technical scheme of the application can detect the scene of most storage type vulnerability attacks in application program, and the detection efficiency is high.

Description

Technical Field

[0001] This invention relates to the field of application vulnerability detection technology, and in particular to a method and system for detecting storage vulnerabilities based on IAST technology. Background Technology

[0002] With the development of the internet, the number of applications has increased significantly, and common web vulnerabilities are detected and protected against using tools like SAST and DAST. Stored vulnerabilities are a special type of vulnerability in applications. If a stored vulnerability exists in an application, an attacker can store attack data in a database via interface A, and then use interface B (which could be the next request or a request sent several days later) to retrieve the previously sent attack data from the database for a coordinated attack. For this type of stored vulnerability, conventional detection methods can only intercept and verify based on a single request, and there are currently no effective detection tools. Detection and interception are generally done manually based on experience, which is relatively inefficient. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for detecting storage vulnerabilities in applications based on IAST technology, which can automatically detect storage vulnerabilities in applications in real time.

[0004] To achieve the above objectives, this invention discloses a method for detecting storage vulnerabilities based on IAST technology, comprising:

[0005] The IAST instrumentation tool is used to instrument the application under test to weave the data stream tracer into the application under test;

[0006] When the application under test requests a data storage operation event for tainted data, the location information of the tainted data stored in the database is obtained and stored to obtain a reference data table.

[0007] When the application enters the tainted data in the application under test and requests the application to perform a data query operation event, it is determined whether the query content matches the content recorded in the reference data table. If so, the current query content is marked with a feature using the marking information.

[0008] Track the data flow of the tainted data and determine whether the query content with the tagged information appears in the output stage or reaches the output stage via the propagation stage. If so, the current application has a stored vulnerability.

[0009] Preferably, when storing the location information of the tainted data in the database in the reference data table, the tainted data and the thread context information when the data storage operation occurs are also stored in association with the location information.

[0010] Preferably, the location information includes the database name, table name, and column name to which the tainted data stored in the application database belongs;

[0011] The method for obtaining the location information includes:

[0012] Track the data flow of the tainted data to obtain the stored and executed statements of the application's interaction with the database;

[0013] Parse the stored statement to obtain the data table name and column name, and parse the executed statement to obtain the database name;

[0014] Methods for determining whether the query content matches the content recorded in the reference data table include:

[0015] The data flow of the tainted data is tracked to obtain the query and execution statements of the application's interaction with the database, and the query and execution statements are parsed to obtain the target location of the current application's access to the database.

[0016] The system uses a polling method to query whether the target location matches the location information in the reference data table. If it does, the query content returned by the query statement matches the content recorded in the reference data table.

[0017] Preferably, the operation events of tainted data currently entering the application on the database are determined by the keywords in the SQL statements in which the application interacts with the database.

[0018] This invention also discloses a system for detecting storage vulnerabilities based on IAST technology, comprising:

[0019] The instrumentation module is used to instrument the application under test using the IAST instrumentation tool to weave the data stream tracer into the application under test.

[0020] The reference data acquisition module is used to obtain the location information of the tainted data stored in the database when the tainted data in the application under test requires the application to perform a data storage operation event, and to store the location information to obtain the reference data table.

[0021] The tagging module is used to mark the query content with tags when the application requests a data query operation event from the tainted data in the application under test, and if the query content matches the content recorded in the reference data table.

[0022] The confirmation module is used to confirm the existence of a storage vulnerability in the current application by determining whether the query content with the marked information appears in the output stage of the data stream of the tainted data or reaches the output stage via the propagation stage.

[0023] Preferably, the reference data acquisition module also associates and stores the tainted data and the thread context information at the time of the data storage operation with the location information in the reference data table.

[0024] Preferably, the location information includes the database name, table name, and column name to which the tainted data stored in the application database belongs;

[0025] The reference data acquisition module includes a first data acquisition module and a first parsing module;

[0026] The first data acquisition module is used to obtain the stored statements and executed statements of the application interacting with the database by tracking the data stream of the tainted data;

[0027] The first parsing module is used to parse the stored statement collected by the first data acquisition module to obtain the data table name and column name, and to parse the executed statement to obtain the database name;

[0028] The marking module includes a second data acquisition module, a second parsing module, and a polling module;

[0029] The second data acquisition module is used to obtain the query statements and execution statements of the application interacting with the database by tracking the data stream of the tainted data;

[0030] The second parsing module is used to parse the query statement and the execution statement to obtain the target location of the current application accessing the database;

[0031] The polling module is used to query whether the target location matches the location information in the reference data table using a polling method, so as to confirm whether the query content returned by the query statement matches the content recorded in the reference data table.

[0032] Preferably, the system further includes a data operation judgment module, which is used to determine the operation events of tainted data currently entering the application on the database by using keywords in the SQL statements in which the application interacts with the database.

[0033] This invention also discloses a system for detecting storage vulnerabilities based on IAST technology, comprising:

[0034] One or more processors;

[0035] Memory;

[0036] And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the method for detecting storage vulnerabilities based on IAST technology as described above.

[0037] The present invention also discloses a computer-readable storage medium comprising a computer program that can be executed by a processor to perform the method for detecting storage vulnerabilities based on IAST technology as described above.

[0038] Compared with existing technologies, the above-mentioned technical solution of the present invention is specifically designed for real-time detection of stored vulnerabilities in applications. During the application's operation, the data flow of tainted data entering the application is tracked and detected in real time using instrumentation tools. When a user-inputted request, i.e., tainted data, is extracted from the database, if the data is data that other users requested and that is pre-existing in the database, and the extracted data is also output through sensitive functions such as SQL execution or command-line execution, then it is determined that the current application has a stored vulnerability. Thus, it can be seen that the above technical solution can detect most scenarios of stored vulnerability attacks in applications, and the detection efficiency is high. Attached Figure Description

[0039] Figure 1 This is a flowchart of a method for detecting storage vulnerabilities in an embodiment of the present invention.

[0040] Figure 2 This is a storage structure diagram of the reference data table in an embodiment of the present invention. Detailed Implementation

[0041] To illustrate the technical content, structural features, objectives, and effects of the present invention in detail, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0042] This embodiment discloses a method for detecting stored vulnerabilities based on IAST technology, for detecting stored vulnerabilities in applications (especially web applications). Specifically, the method includes the following steps:

[0043] S1: The application under test is instrumented using the IAST instrumentation tool to weave a data flow tracer into the application under test. Based on this data flow tracer, the data flow of tainted data in the application can be tracked.

[0044] S2: Based on the data flow tracing procedure, obtain the data flow of tainted data in the application, and determine whether the current tainted data requires the application to perform a data storage operation event based on the database interaction function entered by the tainted data. If yes, proceed to step S30 below; if no, it means that the current tainted data requires the application to perform a data query operation event, then proceed to step S40 below.

[0045] Specifically, the input parameter information, i.e. the SQL statement, is obtained through the instrumented database interaction function such as java.sql.Connection#prepareStatement(java.lang.String). Then, the action performed by the current application through the database interaction function is determined by the keywords in the SQL statement, such as select, update, delete, insert, etc. If it is insert or update, it means that it is a data storage operation; if it is select, it means that it is a database query operation.

[0046] S30: Obtain the location information of the tainted data stored in the database, and store the location information to obtain a reference data table. Specifically, in this embodiment, the location information includes the database name, table name, and column name to which the tainted data stored in the application database belongs.

[0047] S40: Determine whether the query content matches the content recorded in the reference data table. If yes, it means that the data to be extracted by the current tainted data is data from user input stored in other prior requests. Then proceed to step S41. If no, do not perform any operation on the current query content.

[0048] S41: Use tagging information to mark the features of the current query content.

[0049] S42: Track the data flow of tainted data and determine whether the query content with the tagged information appears in the output stage or reaches the output stage via the propagation stage. If so, confirm that the current application has a stored vulnerability; otherwise, end the process.

[0050] The method for detecting stored-type vulnerabilities disclosed in the above embodiments applies to the following vulnerability scenario: a request is made to store tainted data in the database, but this request is not executed; subsequently, a request is made to retrieve the previously requested tainted data from the database and execute it. If this scenario occurs, it indicates that the current application has a stored-type vulnerability. Therefore, the inventive concept of the method for detecting stored-type vulnerabilities in the above embodiments is to determine whether an application has a stored-type vulnerability based on the following two conditions: first, the data retrieved from the database by the subsequent request originates from the user-inputted data requested in the previous request; second, after retrieving the previously requested data from the database, the subsequent request passes the data to a sensitive function (such as SQL execution or command-line execution) and then outputs it. Thus, this method can detect most scenarios of stored-type vulnerability attacks in applications with high detection efficiency.

[0051] In the above embodiments, the database interaction function performs data storage operations or data query operations based on the input parameter information (SQL statement). For example, when the input parameter SQL statement is `insert into users(name,sex)values(request.getParameter("name"),request.getParameter("sex"))`, the executed statement is:

[0052]

[0053] Accordingly, when a database interaction function performs a data query operation, its specific execution statement is as follows:

[0054]

[0055] Therefore, by parsing the input parameter information of the current database interaction function, we can obtain the table name and column name of the data to be stored or retrieved in the database. By parsing the object in the current database interaction function (Connection in the above execution statement), we can obtain the database name information of the data to be stored or retrieved in the database (test in the above execution statement).

[0056] Based on this, in this embodiment, the method for obtaining the location information of data stored in the data specifically includes:

[0057] First, trace the data flow of tainted data to obtain the stored statements (SQL statements) and executed statements used by the application to interact with the database.

[0058] Then, the stored statement is parsed to obtain the table name and column names, and the executed statement is parsed to obtain the database name. Based on the specific stored statement and corresponding executed statement disclosed in the above embodiment, the table name is "users," the column names are "name" and "sex," and the database name is "test."

[0059] Once the location information is obtained, it is stored in a reference data table, such as... Figure 2 As shown, the data in the reference data table is stored in a tree structure.

[0060] Accordingly, methods for determining whether the query content matches the content of records in the reference data table include:

[0061] First, trace the data flow of the tainted data to obtain the query statements (SQL statements) and execution statements used by the application to interact with the database.

[0062] Then, the query and execution statements are parsed to determine the target location of the database accessed by the current application.

[0063] Next, a polling method is used to check whether the target location matches the location information in the reference data table. If it does, it means that the query content returned by the query statement matches the content recorded in the reference data table.

[0064] In this embodiment, when the query statement is "select name,sex from users where name = 'zhangsan'", the table name is "users", the column names are "name" and "sex" are extracted through lexical analysis, and the Connection object in the execution statement is "test" obtained through instrumentation. Therefore, the target location can match the content recorded in the reference data table, and the current application has a stored vulnerability.

[0065] Furthermore, when storing the location information of tainted data in the database in the reference data table, the tainted data and the thread context information when the data storage operation occurred are also stored together with the location information. In this way, when a storage vulnerability is detected, the source and outbreak point of the storage vulnerability can be accurately located by combining the tainted data and thread context information stored in the current and reference data tables.

[0066] In another preferred embodiment of the present invention, a system for detecting storage vulnerabilities based on IAST technology is also disclosed, which includes an instrumentation module, a reference data acquisition module, a marking module, and an verification module.

[0067] The instrumentation module is used to instrument the application under test using the IAST instrumentation tool to weave the data stream tracer into the application under test.

[0068] The reference data acquisition module is used to obtain the location information of the tainted data stored in the database when the application under test requests the application to perform a data storage operation event for the tainted data, and to store the location information in order to obtain the reference data table.

[0069] The tagging module is used to mark the current query content with tags when the application under test requests a data query operation event based on the tainted data in the application under test, and whether the query content matches the content recorded in the reference data table.

[0070] The verification module is used to confirm the existence of a stored vulnerability in the current application by determining whether the query content with tagged information appears in the output stage of the tainted data stream or reaches the output stage via the propagation stage.

[0071] Optionally, the reference data acquisition module also associates and stores tainted data and thread context information and location information at the time of data storage operation in the reference data table.

[0072] Furthermore, the location information includes the database name, table name, and column name to which the tainted data belongs in the application database.

[0073] The reference data acquisition module includes a first data acquisition module and a first parsing module.

[0074] The first data acquisition module is used to obtain stored and executed statements of the application's interaction with the database by tracking the data stream of tainted data.

[0075] The first parsing module is used to parse the stored statements collected by the first data acquisition module to obtain the data table name and column name, and to parse the executed statement to obtain the database name.

[0076] The tagging module includes a second data acquisition module, a second parsing module, and a polling module.

[0077] The second data acquisition module is used to obtain the query and execution statements of the application and the database by tracking the data stream of tainted data.

[0078] The second parsing module is used to parse the query and execution statements to obtain the target location of the database accessed by the current application.

[0079] The polling module is used to query whether the target location matches the location information in the reference data table, in order to confirm whether the query content returned by the query statement matches the content recorded in the reference data table.

[0080] Furthermore, the system also includes a data operation judgment module, which is used to determine the database operation events of tainted data currently entering the application through the keywords in the SQL statements in which the application interacts with the database.

[0081] It should also be noted that the working principle and operation mode of the system for detecting storage vulnerabilities based on IAST technology in this embodiment are detailed in the above-mentioned method for detecting storage vulnerabilities based on IAST technology, and will not be repeated here.

[0082] This invention also discloses another system for detecting storage vulnerabilities, comprising one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the storage vulnerability detection method as described above. The processor may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, used to execute the relevant program to implement the functions required by the modules in the storage vulnerability detection system of this application embodiment, or to execute the storage vulnerability detection method of this application method embodiment.

[0083] This invention also discloses a computer-readable storage medium comprising a computer program executable by a processor to perform the method for detecting storage vulnerabilities as described above. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be read-only memory (ROM), random access memory (RAM), or magnetic media, such as floppy disks, hard disks, magnetic tapes, magnetic disks, or optical media, such as digital versatile discs (DVDs), or semiconductor media, such as solid-state disks (SSDs).

[0084] This application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned method for detecting storage vulnerabilities.

[0085] The above-disclosed embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A method for detecting storage vulnerabilities based on IAST technology, characterized in that, include: The IAST instrumentation tool is used to instrument the application under test to weave the data stream tracer into the application under test; When the application under test requests a data storage operation event for tainted data, the location information of the tainted data stored in the database is obtained and stored to obtain a reference data table. When the application enters the tainted data in the application under test and requests the application to perform a data query operation event, it is determined whether the query content matches the content recorded in the reference data table. If so, the current query content is marked with a feature using the marking information. Track the data flow of the tainted data and determine whether the query content with the tagged information appears in the output stage or reaches the output stage via the propagation stage. If so, the current application has a storage vulnerability. In the reference data table, when storing the location information of the tainted data in the database, the tainted data and the thread context information when the data storage operation occurred are also stored in association with the location information.

2. The method for detecting storage vulnerabilities based on IAST technology according to claim 1, characterized in that, The location information includes the database name, table name, and column name to which the tainted data stored in the application database belongs; The method for obtaining the location information includes: Track the data flow of the tainted data to obtain the stored and executed statements of the application's interaction with the database; Parse the stored statement to obtain the data table name and column name, and parse the executed statement to obtain the database name; Methods for determining whether the query content matches the content recorded in the reference data table include: The data flow of the tainted data is tracked to obtain the query and execution statements of the application's interaction with the database, and the query and execution statements are parsed to obtain the target location of the current application's access to the database. The system uses a polling method to query whether the target location matches the location information in the reference data table. If it does, the query content returned by the query statement matches the content recorded in the reference data table.

3. The method for detecting storage vulnerabilities based on IAST technology according to claim 1, characterized in that, The operation events of tainted data currently entering the application on the database are determined by the keywords in the SQL statements used by the application to interact with the database.

4. A system for detecting storage vulnerabilities based on IAST technology, characterized in that, include: The instrumentation module is used to instrument the application under test using the IAST instrumentation tool to weave the data stream tracer into the application under test. The reference data acquisition module is used to obtain the location information of the tainted data stored in the database when the tainted data in the application under test requires the application to perform a data storage operation event, and to store the location information to obtain the reference data table. The tagging module is used to tag the current query content with tagging information when the application under test requests a data query operation event based on the tainted data in the application under test, and if the query content matches the content recorded in the reference data table. The confirmation module is used to confirm the existence of a storage vulnerability in the current application by determining whether the query content with the marked information appears in the output stage of the data stream of the tainted data or reaches the output stage through the propagation stage; the reference data acquisition module also associates and stores the tainted data and the thread context information when the data storage operation occurs with the location information in the reference data table.

5. The system for detecting storage vulnerabilities based on IAST technology according to claim 4, characterized in that, The location information includes the database name, table name, and column name to which the tainted data stored in the application database belongs; The reference data acquisition module includes a first data acquisition module and a first parsing module; The first data acquisition module is used to obtain the stored statements and executed statements of the application interacting with the database by tracking the data stream of the tainted data; The first parsing module is used to parse the stored statement collected by the first data acquisition module to obtain the data table name and column name, and to parse the executed statement to obtain the database name; The marking module includes a second data acquisition module, a second parsing module, and a polling module; The second data acquisition module is used to obtain the query statements and execution statements of the application interacting with the database by tracking the data stream of the tainted data; The second parsing module is used to parse the query statement and the execution statement to obtain the target location of the current application accessing the database; The polling module is used to query whether the target location matches the location information in the reference data table using a polling method, so as to confirm whether the query content returned by the query statement matches the content recorded in the reference data table.

6. The system for detecting storage vulnerabilities based on IAST technology according to claim 4, characterized in that, It also includes a data operation judgment module, which is used to determine the operation events of tainted data currently entering the application on the database by using keywords in the SQL statements in which the application interacts with the database.

7. A system for detecting storage vulnerabilities based on IAST technology, characterized in that, include: One or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the method for detecting storage vulnerabilities based on IAST technology as described in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that, Includes a computer program that can be executed by a processor to perform the method for detecting storage vulnerabilities based on IAST technology as described in any one of claims 1 to 3.

Images