Web application framework vulnerability detection method and device and computer equipment

Abstract

The application relates to a web application framework vulnerability detection method and device and computer equipment. The method comprises the following steps: obtaining a first process name of a first process running a program of a target web application and framework version information of the program according to an import function of the program; obtaining a second process name of a second process corresponding to at least one web application in a server and path information of the second process; comparing the first process name and the second process name; in the case that the first process name and the second process name are the same, determining framework vulnerability information of the target web application based on the framework version information of the first process and the path information of the second process. The web application framework vulnerability detection method provided in the application embodiment can quickly locate the framework position and timely repair, can reduce or avoid losses caused by the vulnerability at the first time when the vulnerability is found, and effectively improves the repair efficiency of the framework vulnerability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, in particular to a web application framework vulnerability detection method and device and computer equipment. BACKGROUND

[0002] With the rapid development of computer technology and network technology, a series of new Internet products such as web2.0 and network socialization have also been born, and Internet applications based on web environment are also becoming more and more widespread. In the process of enterprise informatization, more and more applications are set up on the web platform.

[0003] However, the rapid development of web business has highlighted the web security threat. Malicious attackers use the vulnerabilities of website operating systems and 0day vulnerabilities of web service programs to obtain control permissions of web servers, and the consequences range from tampering with web page content to stealing important internal data, and even more serious, planting malicious code in web pages to harm website visitors. Web framework is widely used in the process of web application development, and covers a wide range. Therefore, web application framework vulnerabilities will greatly affect web applications, so the security of web application framework has always been the focus of malicious attackers.

[0004] In the related technology of web application security, the crawler is usually used to obtain web page information and analyze it to determine the framework vulnerability. However, the framework vulnerability information determined by the related technology only contains the information of the vulnerability itself, which is difficult to quickly locate the vulnerability framework position in the device or system where the vulnerability occurs and to repair it in time, and it is also difficult to reduce or avoid the loss caused by the vulnerability at the first time when the vulnerability is found, so the framework vulnerability repair efficiency is low. SUMMARY

[0005] Therefore, it is necessary to provide a web application framework vulnerability detection method, device and computer equipment capable of improving the vulnerability repair efficiency in view of the above technical problems.

[0006] In a first aspect, the present application provides a web application framework vulnerability detection method. The method comprises:

[0007] According to the import function of the program of the target web application in the server, the first process name of the first process running the program and the framework version information are obtained;

[0008] The second process name of the second process corresponding to at least one web application in the server and the path information of the second process are obtained;

[0009] The first process name and the second process name are compared, and in the case that the first process name and the second process name are the same, framework vulnerability information of the target web application is determined based on framework version information of the first process and path information of the second process.

[0010] In one embodiment, the first process name of the first process running the program of the target web application is obtained according to an import function of the program.

[0011] The import function is hijacked based on a hook function to obtain an import object name and a first process name of the import function, wherein the import object name includes any one of a class name, a function name or a framework name;

[0012] Framework version information is determined based on the import object name.

[0013] In one embodiment, the framework version information is determined based on the import object name, including:

[0014] It is judged whether the import object name exists in a framework name information library, wherein the framework name information library is constructed based on a framework name of a program language corresponding to the target web application;

[0015] If the import object name exists, it is determined that the import object name is a framework name, and framework version information is determined based on the framework name.

[0016] In one embodiment, the framework version information is determined based on the framework name, including:

[0017] Storage location information of the framework is determined based on the framework name;

[0018] The framework version information is determined based on the storage location information of the framework.

[0019] In one embodiment, the storage location information of the framework is determined based on the framework name, including:

[0020] Framework storage directory information in a directory database is determined based on the framework name, wherein the directory database includes at least one of a program process directory of the target web application, a program import directory of the target web application, a static link library directory and a third-party module installation directory;

[0021] The storage location information of the framework is determined based on the framework storage directory information.

[0022] In one embodiment, the second process name of the second process corresponding to at least one web application in the server is obtained, including:

[0023] obtaining process number information of a currently running program in a process information virtual file directory;

[0024] determining a process name corresponding to the process number information as the second process name.

[0025] In one embodiment, the determining the framework vulnerability information of the target web application based on the framework version information of the first process and the path information of the second process further comprises:

[0026] obtaining program parameter information corresponding to the framework vulnerability of the target web application, the program parameter information comprising user information and port information;

[0027] determining the framework vulnerability information of the target web application based on the framework version information of the first process, the path information of the second process and the program parameter information, the framework vulnerability information of the target web application comprising vulnerability path information, vulnerability user information and vulnerability port information.

[0028] In one embodiment, after the determining the web application framework vulnerability information based on the framework version information of the first process, the path information of the second process and the program parameter information, the method further comprises:

[0029] determining vulnerability source information and vulnerability repair information based on the framework vulnerability information of the target web application, the vulnerability source information comprising server information and / or port information;

[0030] repairing the framework vulnerability of the target web application based on the vulnerability source information and the vulnerability repair information.

[0031] In a second aspect, the present application further provides a web application framework vulnerability detection device. The device comprises:

[0032] a framework version information determination module configured to obtain a first process name and framework version information of a first process running a program of a target web application in a server according to an import function of the program;

[0033] a path information determination module configured to obtain a second process name of a second process corresponding to at least one web application in the server and path information of the second process;

[0034] a framework vulnerability information determination module configured to compare the first process name and the second process name, and in the case that the first process name and the second process name are the same, determine framework vulnerability information of the target web application based on the framework version information of the first process and the path information of the second process.

[0035] In a third aspect, the present application provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the processor executes the steps of the web application framework vulnerability detection method according to any one of the first aspect.

[0036] The web application framework vulnerability detection method, device and computer device provided by the present application can obtain the first process name of the first process running the program of the target web application and the framework version information of the first process according to the import function of the program, and obtain the second process name of the second process corresponding to at least one web application in the server and the path information of the second process, and determine the framework vulnerability information of the target web application based on the framework version information of the first process and the path information of the second process when the first process name and the second process name are the same. The web application framework vulnerability detection method provided by the present application can accurately and timely detect the framework vulnerability information called by the currently running process, and does not detect the framework that has been installed but not used, thereby effectively improving the effectiveness of vulnerability detection, saving the operation resources to a certain extent, and improving the accuracy and effectiveness of the vulnerability detection result. On the other hand, the framework vulnerability information of the web application is determined based on the framework version information and the path information, so that the path information of the framework is included in the framework vulnerability information of the web application, which facilitates rapid positioning of the framework position and timely repair, can reduce or avoid the loss caused by the vulnerability at the first time when the vulnerability is found, and effectively improves the repair efficiency of the framework vulnerability.

[0037] Details of one or more embodiments of the present application are presented in the following drawings and description to make other features, objects and advantages of the present application more apparent. BRIEF DESCRIPTION OF DRAWINGS

[0038] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application, and the illustrative embodiments of the present application and their description serve to explain the present application, and do not constitute an improper limitation on the present application. In the drawings:

[0039] Figure 1 An application environment diagram of the web application framework vulnerability detection method in an embodiment;

[0040] Figure 2 A flowchart of the web application framework vulnerability detection method in an embodiment;

[0041] Figure 3 A structural diagram of the web application framework vulnerability detection system in an embodiment;

[0042] Figure 4 a structural block diagram of a web application framework vulnerability detection device in an embodiment;

[0043] Figure 5 an internal structural diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0044] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0045] Unless otherwise defined, technical terms or scientific terms used in the present application shall have the general meaning understood by a person with ordinary skill in the art to which the present application belongs. In the present application, the terms "one", "a", "an", "the", "these", and similar words do not represent a quantitative limitation, but can be singular or plural. In the present application, the terms "include", "contain", "have" and any variants thereof are intended to cover non-exclusive inclusion; for example, a process, method and system, product or device containing a series of steps or modules (units) are not limited to the listed steps or modules (units), but can include steps or modules (units) not listed, or can include other steps or modules (units) inherent to the process, method, product or device. In the present application, the terms "connected", "connected", "coupled" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. In the present application, "multiple" refers to two or more. The association between the associated objects is described by the term "and / or", which means that there can be three relationships, for example, "A and / or B" can mean that A exists alone, A and B exist together, and B exists alone. In general, the character " / " represents an "or" relationship between the objects before and after it. In the present application, the terms "first", "second", "third" and the like are only used to distinguish similar objects, and do not represent a specific order of the objects.

[0046] The terms "module", "unit" and the like used below are a combination of software and / or hardware that can achieve a predetermined function. Although the devices described in the following embodiments are preferably implemented in hardware, software or a combination of software and hardware implementation is also possible and contemplated.

[0047] The web application framework vulnerability detection method provided by the embodiments of the present application can be applied to, for example, Figure 1The application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data required by the server 104 to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. According to the import function of the program of the target web application in the server 104, the first process name of the first process running with the program and the framework version information are obtained, and the second process name of the second process corresponding to at least one web application in the server 104 and the path information of the second process are obtained. The server 104 compares the first process name and the second process name, and in the case that the first process name and the second process name are the same, the framework vulnerability information of the target web application is determined based on the framework version information of the first process and the path information of the second process. In other embodiments, after the server 104 determines the first process name and the framework version information of the first process and the second process name and the path information of the second process, the above information can also be sent to the terminal 102, and the terminal 102 compares the first process name and the second process name, and in the case that the first process name and the second process name are the same, the framework vulnerability information of the target web application is determined based on the framework version information of the first process and the path information of the second process. Among them, the terminal 102 can be, but not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

[0048] With the rapid development of computer technology and network technology, a series of new Internet products such as web2.0 and network socialization have also been born, and Internet applications based on web environment are also more and more widely used in the process of enterprise informatization. However, the rapid development of web business makes web security threats more and more prominent. Malicious attackers use the vulnerabilities of website operating systems and 0day vulnerabilities of web service programs to obtain control permissions of web servers, which may tamper with web page content, steal important internal data, or even more seriously, implant malicious code in web pages, causing website visitors to be harmed. Web framework is widely used in the process of web application development, and covers a wide range, so web application framework vulnerabilities will greatly affect web applications, so the security of web application framework has always been the focus of malicious attackers.

[0049] In the related art of web application security, a crawler is usually used to obtain web page information and determine a framework vulnerability after parsing. However, the framework vulnerability information determined by the related art only contains information of the vulnerability itself, and it is difficult to quickly locate the vulnerability framework position in the device or system where the vulnerability is generated and to repair it in time, and it is also difficult to reduce or avoid the loss caused by the vulnerability at the first time when the vulnerability is found, so the framework vulnerability repair efficiency is low. In addition, the way of obtaining vulnerability information through a crawler can only be used for websites, and it is impossible to detect vulnerabilities for application programs, components and the like, so it will not be possible to obtain web page information for vulnerability detection in application scenarios where the network condition is poor, the use of a crawler is prohibited, or the web page information does not contain framework information. Furthermore, the way of obtaining web page information through a crawler to determine vulnerability information can only determine the components with vulnerabilities in the server, and it is difficult to determine the process information with vulnerabilities, so it is difficult to locate the framework with vulnerabilities, and it is also difficult to confirm whether the framework is running, and it is difficult to ensure the effectiveness of the detection result. In addition, there is a method of detecting framework vulnerabilities by full-scan in the related art, which has low detection efficiency, and it is difficult to confirm the process information corresponding to the framework information, so it is also difficult to confirm whether the framework is running, and it is difficult to ensure the effectiveness of the detection result.

[0050] Based on this, as shown in Figure 2 , a web application framework vulnerability detection method is provided, which is applied to the application scenario in Figure 1 for example, including the following steps:

[0051] S201: According to the import function of the program of the target web application in the server, the first process name and framework version information of the first process running the program are obtained.

[0052] In the embodiments of the present application, the program of the target web application includes an application program accessed through a web, specifically, the program of the web application includes a computer software application program coded based on a programming language and presenting the execution result of the program in the server through a web browser, and the programming language can include HTML, PHP, Python, ASP and the like. The web application can include a chat room, a forum, a search platform and the like. The program of the web application usually uses an import function to import specific frameworks, classes and interfaces when running, and according to the import function, the first process name and framework version information of the first process running the program of the web application can be obtained.

[0053] The framework in the embodiments of the present application includes a set of cooperating classes constituting a specific software reusable design, and the framework defines the overall structure of the web application, the division of classes and objects, the main responsibilities of each part, the cooperation mode of classes and objects, and the control flow, so that the development process of the web application has engineering, simplicity and stability. Correspondingly, the program of the web application developed based on the framework may also have vulnerabilities, different versions of the framework correspond to different vulnerability information, so that the version information of the web application framework can be obtained to efficiently obtain the vulnerability information of the framework and the corresponding repair information to repair the vulnerabilities.

[0054] In the embodiments of the present application, the import function of the program of the target web application in the server can include the import function of the program of the web application running based on the target programming language. The target programming language can include HTML, PHP, Python, ASP, etc. It can be understood that each target programming language includes a corresponding import function, and the first process name obtained by the import function of the program of the web application running based on the target programming language includes the name of the process running in the target programming language. For example, in a specific embodiment, the corresponding target programming language of the program of the web application is Python, the import function is the import function, and the first process of the program of the web application running based on the import function is the process of executing the Python programming language. Correspondingly, the first process name is the name of the process of executing the Python programming language.

[0055] In the embodiments of the present application, the first process name and the framework version information of the first process running based on the import function of the program of the target web application in the server can include obtaining parameter information of the import function, determining the first process name and the framework version information of the first process running based on the parameter information, wherein the parameter information includes an import object name and loading process information. The loading process information includes the first process name. In some embodiments, the import object name includes any one of a class name, a function name or a framework name. After obtaining the import object name, it can be judged whether the import object name exists in the framework name information library, if it exists, it is determined that the import object name is the framework name. The framework name information library is constructed based on the framework name of the programming language corresponding to the target web application. The embodiments of the present application can obtain the first process name and the framework version information based on the hook function hijacking the import function. In other embodiments, the first process name and the framework version information can also be obtained based on software or functions similar to the function of the hook function.

[0056] S203: Obtain the second process name of the second process corresponding to at least one web application in the server and the path information of the second process.

[0057] In this embodiment, a web application generates at least one corresponding second process during runtime. Obtaining the second process name and path information of the second process may include obtaining the operating system information of the server, and then obtaining the second process name and path information based on the operating system information. It is understood that servers running different operating systems should use appropriate methods to obtain the second process name and path information of the second process corresponding to the web application. In some specific embodiments, if the server's operating system is Windows, the second process name and path information of the second process corresponding to the web application can be obtained through Task Manager or a task command line program. In other embodiments, if the server's operating system is Linux, the second process name and path information of the second process corresponding to the web application can be obtained through the ps or top command. If the path information of the second process needs to be absolute, it can also be obtained based on the process folder under the proc directory.

[0058] S205: Compare the first process name and the second process name. If the first process name and the second process name are the same, determine the framework vulnerability information of the target web application based on the framework version information of the first process and the path information of the second process.

[0059] In this embodiment, the first process running the target web application on the server and the second process corresponding to at least one web application on the server are both currently running processes of the server. The names of the first and second processes are compared. If the first and second process names are the same, it indicates that the first and second processes point to the same target process. After associating the first and second processes, the framework vulnerability information of the target web application can be determined based on the framework version information of the first process obtained in step S201 and the path information of the second process obtained in step S203. It is understood that the framework vulnerability information of the target web application includes vulnerability path information. Based on this vulnerability information, the server information and framework location information where the vulnerability occurs can be determined, and thus, when a vulnerability occurs, the framework location can be quickly located and repaired in a timely manner.

[0060] The web application framework vulnerability detection method provided in this application obtains the first process name and framework version information of the first process running the target web application based on the import function of the program in the server, as well as the second process name and path information of the second process corresponding to at least one web application in the server. When the first process name and the second process name are the same, the method determines the framework vulnerability information of the target web application based on the framework version information of the first process and the path information of the second process. This web application framework vulnerability detection method, on the one hand, determines web application framework vulnerability information when the first process name and the second process name are the same, which can accurately and promptly detect framework vulnerabilities called by the currently running process, without detecting installed but unused frameworks. Therefore, it effectively improves the effectiveness of vulnerability detection, saves computing resources to a certain extent, and improves the accuracy and effectiveness of vulnerability detection results. On the other hand, determining web application framework vulnerability information based on framework version information and path information ensures that the web application framework vulnerability information includes the framework path information, facilitating rapid location of the framework and timely repair. This can reduce or avoid the losses caused by the vulnerability at the first moment of discovery, effectively improving the efficiency of framework vulnerability repair.

[0061] In this embodiment of the application, the step S201 of obtaining the first process name of the first process running the target web application based on the import function of the program in the server includes:

[0062] S301: Based on the hook function hijacking of the import function, obtain the import object name and the first process name of the import function, wherein the import object name includes any one of class name, function name or framework name.

[0063] S302: Determine the framework version information based on the imported object name.

[0064] In the embodiments of the present application, the import object name and the first process name of the import function can be obtained before or after the import function is run by setting a hook function to hijack the import function. The import object name includes any one of a class name, a function name or a framework name, wherein the class name, the function name or the framework name is a class name, a function name or a framework name loaded in a program of a programming language corresponding to the web application. In some embodiments, if the programming language corresponding to the web application is Python, the import function is an import function. Based on the hook function hijacking the import function, the import object name and the first process name of the import function can include dynamically obtaining the import object name and the first process name based on the hook function hijacking the underlying function corresponding to the import function. The underlying function corresponding to the import function can include importlib.import_module(). Based on the import object name, the framework version information can be determined. If the import object name is a framework name, the framework version information can be determined based on the object name. In the embodiments of the present application, whether the import object name is a framework name can be determined by excluding the class name and the function name. Whether the import object name is a framework name can also be determined by matching the import object name with a framework name information library.

[0065] In the embodiments of the present application, the hook function is used to obtain the import object name and the first process name, and then the framework version information is determined based on the import object name. Since the framework obtained by the hook function is the currently running framework, the framework obtained includes the installed but unused framework, which effectively improves the effectiveness of the framework vulnerability detection and saves the operation resources to some extent.

[0066] In the embodiments of the present application, the step S302 includes:

[0067] S401: Determine whether the import object name exists in the framework name information library, wherein the framework name information library is constructed based on the framework name of the programming language corresponding to the target web application.

[0068] S403: If the import object name exists, it is determined that the import object name is a framework name, and the framework version information is determined based on the framework name.

[0069] In the embodiment of the present application, the framework name information base is constructed based on the framework name of the programming language corresponding to the target web application, and includes common framework names and corresponding framework information. The imported object name is matched with the framework name information base to determine whether the imported object name exists in the framework name information base. If the imported object name exists, it is determined that the imported object name is a framework name, and the framework version information is determined based on the framework name. In the embodiment of the present application, the number of common frameworks for the target web application is small, so the imported object name can be effectively determined to be a framework name based on the framework name information base. If the imported object name is a class name or a function name, it can be excluded in time, thereby improving the efficiency of vulnerability detection.

[0070] In the embodiment of the present application, the determination of the framework version information based on the framework name includes:

[0071] S501: determining the storage location information of the framework based on the framework name.

[0072] S503: determining the framework version information based on the storage location information of the framework.

[0073] In the embodiment of the present application, after the framework name is determined, the framework name can be used as a keyword to search in the target storage location to obtain the storage location information of the framework. After the storage location information is obtained, the detailed information of the framework can be obtained based on the storage location information of the framework, and then the framework version information is obtained.

[0074] In the embodiment of the present application, the determination of the storage location information of the framework based on the framework name includes:

[0075] S601: determining the framework storage directory information in a directory database based on the framework name, the directory database including at least one of a program process directory of currently running the target web application, a program import directory of the target web application, a static link library directory, and a third-party module installation directory.

[0076] S603: determining the storage location information of the framework based on the framework storage directory information.

[0077] In the embodiment of the present application, the directory database includes the storage directory information corresponding to the framework, and the framework storage directory information in the directory database can be determined based on the framework name. The storage information of the framework is included in the framework storage directory information, so the storage location information of the framework can be determined based on the framework storage directory information. In the embodiment of the present application, the directory database includes at least one of a program process directory of currently running the target web application, a program import directory of the target web application, a static link library directory, and a third-party module installation directory.

[0078] In some embodiments, if the programming language corresponding to the web application is Python, determining the storage location information of the framework based on the framework name comprises: finding the storage directory information of the framework in a directory database based on the framework name by an import function, the directory database comprising at least one of the directory where the program process of the target web application is located, $PYTHONPATH (program import directory of the target web application), Lib library directory (static link library directory), site-package (Python package) third-party module path. The storage directory information of the framework matching the framework name is determined by traversing the above directory database, and the framework storage location information is further obtained based on the framework name and the framework storage directory information, and then the framework version information is determined.

[0079] In the embodiments of the present application, the second process name of the second process corresponding to at least one web application in the server is obtained by:

[0080] S701: Obtain the process number information of the currently running program in the process information virtual file directory.

[0081] S703: Determine the process name corresponding to the process number information as the second process name.

[0082] In the embodiments of the present application, the process information virtual file directory comprises the process information corresponding to the currently running web application. The process number information of the currently running program in the process information virtual file directory is obtained, and the process name corresponding to the process number information is determined as the second process name. In some embodiments, the second process name of the second process corresponding to at least one web application in the server is obtained by: traversing the process information virtual file directory / proc / directory to obtain the process number information of the currently running program, and traversing the process number directory / proc / process number / based on the process number information to obtain the process name corresponding to the process number information as the second process name.

[0083] In order to trace the location of the vulnerability more accurately and timely, repair the vulnerability more timely or reduce the loss caused by the vulnerability, in the embodiments of the present application, the framework vulnerability information of the target web application is determined based on the framework version information of the first process and the path information of the second process, and further comprises:

[0084] S801: Obtain the program parameter information corresponding to the framework vulnerability of the target web application, the program parameter information comprising user information and port information.

[0085] S901: determine framework vulnerability information of the target web application based on the framework version information of the first process, the path information of the second process, and the program parameter information, wherein the framework vulnerability information of the target web application comprises vulnerability path information, vulnerability user information, and vulnerability port information.

[0086] In the embodiments of the present application, the program parameter information corresponding to the framework vulnerability of the target web application is obtained by obtaining the process parameter information of the second process corresponding to at least one web application in the server, comparing the first process name with the second process name, and in the case that the first process name and the second process name are the same, taking the process parameter information as the program parameter information corresponding to the framework vulnerability of the target web application. The program parameter information comprises user information and port information. In the embodiments of the present application, the framework vulnerability information of the target web application is determined based on the framework version information of the first process, the path information of the second process, and the program parameter information, wherein the framework vulnerability information of the target web application comprises vulnerability path information, vulnerability user information, and vulnerability port information. In the embodiments of the present application, in the determined framework vulnerability information, the vulnerability path information, the vulnerability user information, and the vulnerability port information can quickly locate the corresponding server, process, and port of the vulnerability when the framework vulnerability occurs, thereby improving the vulnerability repair efficiency and timeliness.

[0087] In the embodiments of the present application, after determining the web application framework vulnerability information based on the framework version information of the first process, the path information of the second process, and the program parameter information, the method further comprises:

[0088] S901: determine framework vulnerability information of the target web application based on the framework version information of the first process, the path information of the second process, and the program parameter information, wherein the framework vulnerability information of the target web application comprises vulnerability path information, vulnerability user information, and vulnerability port information.

[0089] S903: repair the framework vulnerability of the target web application based on the vulnerability source information and the vulnerability repair information.

[0090] In the embodiments of the present application, the vulnerability source information and the vulnerability repair information can be determined based on the framework vulnerability information of the target web application. The vulnerability source information comprises server information and / or port information. The vulnerability repair information comprises repair information of the corresponding vulnerability in the version determined based on the framework version information. Repairing the framework vulnerability of the target web application based on the vulnerability source information and the vulnerability repair information can comprise locating the corresponding server, process, and port of the vulnerability based on the vulnerability source information, and repairing the framework vulnerability of the target web application based on the vulnerability repair information.

[0091] The embodiment of the application can detect the framework vulnerability in the currently running web application program in time by acquiring the first process and the second process related information in real time, and on the other hand, can trace the location where the vulnerability occurs at the first time when the vulnerability occurs, and determine the vulnerability repair information by acquiring the vulnerability version information, so as to repair the framework vulnerability such as 0day vulnerability in time and efficiently.

[0092] In one specific embodiment of the application, as shown in Figure 3 The structure diagram of the web application framework vulnerability detection system is shown in FIG. 1. The hijacking module and the information sending module connected with each other are arranged in the web application program, which is used to hijack the underlying function corresponding to the import import function to obtain the framework name information and send it to the information sending module. The information sending module is used to send the framework name information to the framework collection system. The framework collection system includes a receiving hijacked information module, a collection system program information module and an extracting framework path module connected with the correlation analysis module respectively. The receiving hijacked information module is further connected with the information sending module, and the extracting framework path module is further connected with an extracting framework version module. The receiving hijacked information module is used to receive the framework name information hijacked by the hijacking module. The collection system program information module is used to collect the program process information on the server. The correlation analysis module is used to perform correlation analysis on the hijacked framework name information and the collected program process information to determine the detailed information of the framework process. The extracting framework path module is used to extract the framework application path information and the framework installation path information according to the framework name information and the detailed information of the process. The extracting framework version module is used to further extract the version information of the framework according to the framework installation path information.

[0093] It should be understood that, although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or steps or stages in other steps.

[0094] Based on the same inventive concept, the embodiment of the present application further provides a web application framework vulnerability detection device 1100 for implementing the web application framework vulnerability detection method. The device provides a solution to the implementation scheme as described in the above method, and therefore the specific limitations of one or more web application framework vulnerability detection device 1100 embodiments provided below can be referred to the limitations of the web application framework vulnerability detection method in the above, which will not be repeated here.

[0095] In one embodiment, as shown in Figure 4 a web application framework vulnerability detection device 1100 is provided, comprising:

[0096] a framework version information determination module 1101 configured to obtain a first process name of a first process running a program of a target web application and framework version information of the first process according to an import function of the program in a server;

[0097] a path information determination module 1102 configured to obtain a second process name of a second process corresponding to at least one web application in the server and path information of the second process;

[0098] a framework vulnerability information determination module 1103 configured to compare the first process name and the second process name, and in the case that the first process name and the second process name are the same, determine framework vulnerability information of the target web application based on the framework version information of the first process and the path information of the second process.

[0099] Each module in the above web application framework vulnerability detection device 1100 can be realized by software, hardware and their combinations in whole or in part. The above modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory in the computer device in software form, so as to call and execute the operations of the above modules by the processor.

[0100] In one embodiment, a computer device is provided, which can be a terminal, and its internal structure diagram can be as shown in Figure 5As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The communication interface of the computer device is used to communicate with external terminals in a wired or wireless manner. The wireless manner can be achieved through WIFI, mobile cellular network, NFC (near field communication) or other technologies. The computer program is executed by the processor to implement the web application framework vulnerability detection method described in any of the above embodiments. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the computer device. It can also be an external keyboard, touchpad or mouse, etc.

[0101] Those skilled in the art can understand that, Figure 5 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0102] In one embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by the processor to implement the web application framework vulnerability detection method described in any of the above embodiments.

[0103] In one embodiment, a computer program product is provided, which includes a computer program. The computer program is executed by the processor to implement the web application framework vulnerability detection method described in any of the above embodiments.

[0104] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0105] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric memory (Ferroelectric Random Access Memory, FRAM), phase change memory (Phase Change Memory, PCM), graphene memory, etc. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0106] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist contradictory, it should be considered as the scope of the present application.

[0107] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A web application framework vulnerability detection method, characterized in that, The method comprises: According to the import function of the program of the target web application in the server, the first process name and the framework version information of the first process running the program are obtained; Obtain the second process name of the second process corresponding to at least one web application in the server and the path information of the second process; Compare the first process name and the second process name, and in the case that the first process name and the second process name are the same, determine the framework vulnerability information of the target web application based on the framework version information of the first process and the path information of the second process; Wherein, the framework vulnerability information of the target web application is determined based on the framework version information of the first process and the path information of the second process, which further comprises: Obtain the program parameter information corresponding to the framework vulnerability of the target web application, which includes user information and port information; Determine the framework vulnerability information of the target web application based on the framework version information of the first process, the path information of the second process and the program parameter information, which includes vulnerability path information, vulnerability user information and vulnerability port information.

2. The method of claim 1, wherein, According to the import function of the program of the target web application in the server, the first process name of the first process running the program is obtained, which comprises: Based on the hook function to hijack the import function, the import object name and the first process name of the import function are obtained, wherein the import object name includes any one of class name, function name or framework name; Determine the framework version information based on the import object name.

3. The method of claim 2, wherein, The determination of the framework version information based on the import object name comprises: Determine whether the import object name exists in the framework name information library, wherein the framework name information library is constructed based on the framework name of the program language corresponding to the target web application; If it exists, it is determined that the import object name is a framework name, and the framework version information is determined based on the framework name.

4. The method of claim 3, wherein, The determination of the framework version information based on the framework name comprises: Determine the storage location information of the framework based on the framework name; Determine the framework version information based on the storage location information of the framework.

5. The method of claim 4, wherein, The determination of the storage location information of the framework based on the framework name comprises: Determine the framework storage directory information in the directory database based on the framework name, wherein the directory database includes at least one of the program process directory of the current running target web application, the program import directory of the target web application, the static link library directory and the third party module installation directory; Determine the storage location information of the framework based on the framework storage directory information.

6. The method of claim 1, wherein, The determination of the second process name of the second process corresponding to at least one web application in the server comprises: Obtain the process number information of the current running program in the process information virtual file directory; Determine the process name corresponding to the process number information as the second process name.

7. The method of claim 1, wherein, After the web application framework vulnerability information is determined based on the framework version information of the first process, the path information of the second process and the program parameter information, the method further includes: determining vulnerability source information and vulnerability repair information based on the framework vulnerability information of the target web application, the vulnerability source information including server information and / or port information; repairing the framework vulnerability of the target web application based on the vulnerability source information and the vulnerability repair information.

8. A web application framework vulnerability detection apparatus, characterized by comprising: The apparatus includes: a framework version information determination module configured to obtain a first process name and framework version information of a first process running a program according to an import function of the program of a target web application in a server; a path information determination module configured to obtain a second process name and path information of a second process corresponding to at least one web application in the server; a framework vulnerability information determination module configured to compare the first process name and the second process name, and determine framework vulnerability information of the target web application based on the framework version information of the first process and the path information of the second process in a case where the first process name and the second process name are the same, wherein the determination of the framework vulnerability information of the target web application based on the framework version information of the first process and the path information of the second process further includes: obtaining program parameter information corresponding to the framework vulnerability of the target web application, the program parameter information including user information and port information; determining the framework vulnerability information of the target web application based on the framework version information of the first process, the path information of the second process and the program parameter information, the framework vulnerability information of the target web application including vulnerability path information, vulnerability user information and vulnerability port information. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor implements the steps of the method of any one of claims 1 to 7 when executing the computer program.

Images