Vulnerability mining method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a vulnerability mining method and device, electronic equipment and storage medium, and relate to the technical field of information security, the method comprises: obtaining the Array object corresponding to the target system and the historical vulnerability data corresponding to the Array object, and obtaining the object data corresponding to the Array object, the object data at least includes object processing behavior, function method and object attribute; according to the historical vulnerability data, object processing behavior, function method and object attribute, an execution sample for vulnerability mining of the target system is constructed; in response to inputting the execution sample into the browser engine for execution, if it is found that the object attribute corresponding to the Array object has changed abnormally during the execution process, a first target vulnerability corresponding to the abnormal change is determined, thereby improving the concentration of the target in the vulnerability mining process, improving the mining efficiency, at the same time, the vulnerability mining can be concentrated on the Array object for mining, and the mining efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a vulnerability mining method, a vulnerability mining device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] For vulnerability mining, it refers to finding security vulnerabilities or potential security weaknesses in software, systems or networks by analyzing the code and configuration. Vulnerability mining aims to find and exploit these vulnerabilities to help developers and security experts improve the security of the system. However, in the process of vulnerability mining, it is usually necessary to deeply analyze the internal working principle and code logic of the target system, which results in that a lot of time is consumed in the process of vulnerability mining, and the complexity of the vulnerability mining process is also increased, and the availability of the mined vulnerabilities cannot be guaranteed. SUMMARY

[0003] The embodiments of the present application provide a vulnerability mining method, device, electronic device and computer readable storage medium to solve or partially solve the problems of long time consumption, complex process and low availability of mined vulnerabilities in the process of vulnerability mining.

[0004] The embodiments of the present application disclose a vulnerability mining method applied to a browser engine, comprising:

[0005] An Array object corresponding to a target system and historical vulnerability data corresponding to the Array object are obtained, and object data corresponding to the Array object is obtained, the object data at least including object processing behavior, function method and object attribute, and the Array object is an array object in the target system;

[0006] An execution sample for vulnerability mining of the target system is constructed according to the historical vulnerability data, the object processing behavior, the function method and the object attribute.

[0007] In response to inputting the execution sample into the browser engine for execution, if it is found that the object attribute corresponding to the Array object has an abnormal change in the execution process, a first target vulnerability corresponding to the abnormal change is determined, and the first target vulnerability represents a type confusion vulnerability corresponding to the Array object.

[0008] The embodiments of the present application also disclose a vulnerability mining device applied to a browser engine, comprising:

[0009] The data acquisition module is configured to acquire an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and acquire object data corresponding to the Array object, the object data including at least object processing behavior, function device and object attribute.

[0010] The sample construction module is configured to construct an execution sample for vulnerability mining of the target system according to the historical vulnerability data, the object processing behavior, the function device and the object attribute.

[0011] The first vulnerability mining module is configured to, in response to inputting the execution sample into the browser engine for execution, determine a first target vulnerability corresponding to an abnormal change of an object attribute of an Array object if the abnormal change of the object attribute is found in an execution process.

[0012] The embodiment of the application further discloses an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete mutual communication through the communication bus.

[0013] The memory is used for storing a computer program.

[0014] The processor is used for executing the program stored on the memory, and realizes the method as described in the embodiment of the application.

[0015] The embodiment of the application further discloses a computer readable storage medium, which stores instructions, and when executed by one or more processors, makes the processor execute the method as described in the embodiment of the application.

[0016] The embodiment of the application has the following advantages:

[0017] In the embodiment of the present application, it can be applied to a browser engine, in the process of vulnerability mining of a target system, the browser engine can acquire an Array object corresponding to the target system and historical vulnerability data corresponding to the Array object, and acquire object data corresponding to the Array object, the object data at least including object processing behavior, function method and object attribute, the Array object is an array object in the target system, then according to the historical vulnerability data, the object processing behavior, the function method and the object attribute, an execution sample for vulnerability mining of the target system is constructed, and then in response to inputting the execution sample into the browser engine for execution, if it is found that the object attribute corresponding to the Array object has an abnormal change in the execution process, a first target vulnerability corresponding to the abnormal change is determined, the first target vulnerability represents a type confusion vulnerability corresponding to the Array object, the corresponding execution sample is constructed through the historical vulnerability data, the object processing behavior, the function method and the object attribute, the possible vulnerability characteristics, the type and the possible influence factor of the target system are described, the concentration of the target in the vulnerability mining process is improved, the mining efficiency is improved, at the same time, the vulnerability mining can be concentrated on the Array object, the mining process is simplified, at the same time, the accuracy and comprehensiveness of the mining are expanded through rich data, and based on the constructed execution sample, the universality and portability of the vulnerability mining can be improved, and then the usability of the mined target vulnerability is ensured, so that the target system is optimized based on the target vulnerability, and the safety of system running is ensured. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 is a step flow chart of a vulnerability mining method provided in the embodiment of the present application;

[0019] Figure 2 is a schematic diagram of a data structure provided in the embodiment of the present application;

[0020] Figure 3 is a scene diagram of vulnerability mining provided in the embodiment of the present application;

[0021] Figure 4 is a structural block diagram of a vulnerability mining device provided in the embodiment of the present application;

[0022] Figure 5 is a block diagram of an electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0024] As an example, for a corresponding browser, it can use a high-performance JavaScript engine, and the JavaScript engine can be responsible for interpreting and executing JavaScript code in the webpage. Among them, in the related technology, by deeply analyzing the specific browser engine target module, writing test samples, writing fuzz programs and conducting dynamic testing through fuzz programs, and according to the coverage feedback to guide the generation process of the test sample continuously. The current traditional browser engine vulnerability mining faces some challenges and problems, including but not limited to the following aspects:

[0025] Reasonable target selection: In the process of vulnerability mining, selecting appropriate targets for analysis is crucial. Due to the complexity of browser engines and the diversity of vulnerabilities, miners need to carefully evaluate which parts may have security problems and focus on analysis. This requires a deep understanding of the internal working principles and code structure of the browser engine.

[0026] Target code logic is difficult to understand: The code base of the browser engine is large and complex, containing a large number of optimization, interpreter and just-in-time compiler components. The code logic of these components often has high technical complexity, and reading and understanding these codes can be a challenging task. For vulnerability miners, understanding code logic is crucial for discovering potential vulnerability points.

[0027] Optimization mechanisms make it extremely difficult to improve code coverage: Browser engines have powerful optimization mechanisms, including just-in-time compilation and inline caching, which can significantly improve the execution efficiency of JavaScript code. However, these optimization mechanisms also pose challenges to vulnerability mining, as they can lead to the diversity and complexity of code execution paths, thereby increasing the difficulty of code coverage.

[0028] Crash exploitability is extremely low: One of the goals of vulnerability mining is to discover exploitable vulnerabilities to achieve remote code execution or bypass security mechanisms and other attacks. However, browser engines have high quality assurance in terms of security, so there are relatively few crash exploitable vulnerabilities. This makes it more difficult to find exploitable vulnerabilities, requiring miners to have in-depth technical knowledge and innovative thinking.

[0029] High threshold, little accumulation: Browser engine vulnerability mining requires a deep understanding of the underlying operating system and programming language, as well as advanced debugging and reverse engineering skills. This makes vulnerability mining a high threshold, long-term accumulation technical field. Due to the relatively small number of miners, related research and tool support are also relatively limited.

[0030] To this end, in order to solve or partially solve the above-mentioned problems, in the process of vulnerability mining of the target system, the browser engine can obtain the Array object corresponding to the target system and the historical vulnerability data corresponding to the Array object, and obtain the object data corresponding to the Array object, the object data at least including object processing behavior, function method and object attribute, the Array object is an array object in the target system, then according to the historical vulnerability data, the object processing behavior, the function method and the object attribute, an execution sample for vulnerability mining of the target system is constructed, and then in response to inputting the execution sample into the browser engine for execution, if it is found that the object attribute corresponding to the Array object has changed abnormally during the execution process, a first target vulnerability corresponding to the abnormal change is determined, and the first target vulnerability represents a type confusion vulnerability corresponding to the Array object. By constructing the corresponding execution sample based on the historical vulnerability data, the object processing behavior, the function method and the object attribute, the possible vulnerability characteristics, the type and the possible influence factor of the target system are described, the concentration of the target in the vulnerability mining process is improved, the mining efficiency is improved, at the same time, the vulnerability mining can be concentrated on the Array object, the mining process is simplified, at the same time, the accuracy and comprehensiveness of the mining are expanded by rich data, and based on the constructed execution sample, the universality and portability of the vulnerability mining can be improved, and then the usability of the mined target vulnerability is ensured, so as to optimize the target system based on the target vulnerability and ensure the safety of the system running.

[0031] In order for those skilled in the art to better understand the technical solutions in the embodiments of the present application, some technical features involved in the embodiments of the present application are explained and described as follows:

[0032] Type confusion: Type confusion vulnerability is a common software security vulnerability, usually appearing in strongly typed languages such as C / C++. It occurs when incorrect types are used in a program or an object reference is treated as an incorrect type.

[0033] JIT: JIT (Just-In-Time) is a compilation technique commonly used in dynamic language interpreters and virtual machines. JIT compiler compiles source code or intermediate code into machine code in real time during program execution to improve program execution efficiency.

[0034] Reverse engineering: Reverse engineering is a process of analyzing and studying existing products or systems to understand their design, function and operation principle. Reverse engineering aims to reverse analyze existing technology or products to obtain information about their internal mechanisms, algorithms, data structures and design decisions.

[0035] POC (Proof of Concept) is an abbreviation for proof of concept or concept verification. In the field of computer security, POC usually refers to a piece of code or demonstration that proves the existence of a security vulnerability or the feasibility of a function. POC can be a simple script, program or demonstration video that demonstrates the way a security vulnerability is exploited or a new security attack technology is implemented. Through POC, security researchers can show others that there is a real security problem, prompting developers or manufacturers to take measures to fix the vulnerability or strengthen security protection.

[0036] EXP (Exploit) refers to a program or code that exploits security vulnerabilities in computer systems, applications or services to perform illegal or unauthorized operations. EXP can be a specially written code that exploits known or unknown security vulnerabilities to perform malicious operations, such as obtaining system privileges, executing arbitrary code, bypassing security controls, etc. EXP is usually used by hackers or attackers to invade, attack or control target systems.

[0037] Referring to Figure 1 , a step flowchart of a vulnerability mining method provided in an embodiment of the present application is shown, which is applied to a browser engine and can specifically include the following steps:

[0038] Step 101, obtaining an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and obtaining object data corresponding to the Array object, the object data at least including object processing behavior, function method and object attribute, the Array object being an array object in the target system;

[0039] In the embodiment of the present application, the target system can be an object for vulnerability mining. In the process of mining the target system for vulnerabilities, specific objects of the target system can be mined, such as Array objects, etc. In JavaScript, the Array object is a very important built-in object for processing and operating array data. An array is an ordered collection of data that can store multiple values. The Array object provides many methods to operate and process arrays.

[0040] In practical implementation, browser engines may encounter type confusion vulnerabilities due to the similarity in representation between Array and String objects. Both String and Array objects have a fixed data storage structure containing metadata and data content. These objects are represented contiguously in memory. Type confusion can occur by converting a String object to an Array object, or vice versa. Then, modifying the length of the Array object to exceed its allocated memory space allows for out-of-bounds access to data in memory locations that shouldn't be accessed. This out-of-bounds access to unexpected memory data can lead to the acquisition of sensitive information or the exploitation of this data for other attacks, such as address leakage or code execution.

[0041] To address the potential type confusion vulnerability between Array objects and String objects, this embodiment of the invention analyzes the target system and identifies all Array objects corresponding to the target system. Then, it obtains the object data corresponding to each Array object. This object data includes at least object processing behavior, function methods, and object attributes. Specifically, object processing behavior describes the basic operations and behaviors of the Array object; function methods include all methods provided by the Array object and the functionality of each function method; and object attributes include the attributes of the Array object and the corresponding functions.

[0042] For example, the data structure of an Array object can be represented as a JSON object. A JSON object includes at least object handling behaviors, function methods, and object properties. For object handling behaviors, these can include:

[0043] Creating an array: An array can be created using an array literal or the Array constructor.

[0044] Accessing array elements: Accessing elements in an array by index.

[0045] Modify array elements: Modify elements in an array by index.

[0046] Traversing an array: Use methods such as forEach to traverse the elements in an array.

[0047] Concatenate arrays: Use the concat method to join two or more arrays.

[0048] Split an array: Use the slice method to extract a portion of the array.

[0049] Sorted array: Sort the array using the sort method.

[0050] Search array: Search for elements in the array using the indexOf and lastIndexOf methods.

[0051] For function methods, these can include:

[0052] Push: Add one or more elements to the end of the array and return the new length.

[0053] Pop: Remove the element at the end of the array and return it.

[0054] Shift: Remove the element at the beginning of the array and return it.

[0055] Unshift: Add one or more elements to the beginning of the array and return the new length.

[0056] Concat: Join two or more arrays and return a new array.

[0057] Join: Join all elements of the array into a string and return the string.

[0058] Slice: Extract a portion of the array and return a new array.

[0059] Splice: Add or remove elements from the array and return the removed elements.

[0060] ForEach: Execute a provided function once for each element in the array.

[0061] Map: Create a new array with the results of calling a provided function on each element in the original array.

[0062] Filter: Create a new array with all elements that pass a test implemented by a provided function.

[0063] Reduce: Execute a reducer function on each element of the array, reducing the array to a single return value.

[0064] IndexOf: Return the first occurrence of a specified element in the array.

[0065] LastIndexOf: Return the last occurrence of a specified element in the array.

[0066] Sort: Sort the array and return the sorted array.

[0067] Reverse: Reverse the order of the elements in the array.

[0068] For the object attribute, it can be length, etc., that is, the length of the array, etc.

[0069] By obtaining the object processing behavior, function method and object attribute corresponding to the Array object, the object processing behavior can be used to understand how to create an Array object, how to read and modify the elements in the array, how to delete and traverse the array, etc. The function method can be used to deeply analyze the implementation details of the Array object to understand the complex logic operation inside and study the underlying data structure and algorithm of the Array object. The object attribute can be used to analyze the attributes and corresponding functions of the Array object, so that when performing vulnerability mining on the target system, the vulnerability mining can be concentrated on the Array object of the target system.

[0070] In addition, the historical vulnerability data can be the corresponding vulnerability data obtained in the historical running process or the historical mining process of the target system. By introducing the historical vulnerability data, the complexity of the influence factor in the vulnerability mining process can be increased, and the comprehensiveness and accuracy of the vulnerability mining can be improved.

[0071] Step 102, constructing an execution example for vulnerability mining of the target system according to the historical vulnerability data, the object processing behavior, the function method and the object attribute;

[0072] In the embodiment of the application, after the object processing behavior, function method and object attribute of the Array object are determined, the execution example for vulnerability mining of the target system can be constructed based on the historical vulnerability data, the object processing behavior, the function method and the object attribute, so as to perform vulnerability mining on the target system through the execution example, determine the possible vulnerabilities of the target system, and through the construction of the corresponding execution example, the user can not need to deeply analyze the working principle and code logic of the target system, thereby effectively reducing the time and workload of vulnerability mining, and the test example generated by extracting, abstracting and mutating the influence factor is closer to the real attack scene, which can better simulate the potential vulnerability situation, so that the vulnerability mined based on the test example has high exploitability.

[0073] In some feasible implementation manners, the historical vulnerability data, the object processing behavior, the function method and the object data can be combined and mutated to generate a test example for the target system, and then the test example can be converted into an execution example for execution in the browser engine. In the process of converting the test example, the test example can be converted into JavaScript code for execution in the browser engine, so as to execute the converted JavaScript code in the browser engine.

[0074] In a specific implementation, different combination mutation strategies can be designed to combine and mutate historical vulnerability data, object processing behavior, function method, and object attribute, to generate corresponding test samples. For example, test samples that can reproduce the vulnerability can be generated according to historical vulnerability data; test samples that call the function can be generated by combining the function method and the object attribute; test samples that simulate the behavior can be generated according to the object processing behavior; different test samples can be generated by mutating the parameters of the function method; test samples for boundary conditions, such as null, maximum, and minimum, can be generated, so as to construct conditions that can cover possible vulnerabilities of the target system through combination and mutation, and then test the behavior and boundary conditions of the Array object through the constructed test samples.

[0075] Further, after the test case group is constructed, each test case can be translated and JavaScript code that is executed on the browser engine is generated, and then the JavaScript code is passed to the browser engine for execution. During the execution, the JavaScript code can be ensured to be executed in a controlled environment by using the corresponding test environment and work, and the corresponding execution results and log information can be collected based on the execution process.

[0076] In step 103, in response to inputting the execution sample into the browser engine for execution, if it is found that the object attribute corresponding to the Array object has an abnormal change during the execution, a first target vulnerability corresponding to the abnormal change is determined. The first target vulnerability represents a type confusion vulnerability corresponding to the Array object.

[0077] In the embodiment of the present application, after the execution sample is input into the browser engine for execution, the attribute change of the Array object can be recorded and observed, especially the change related to type confusion. If it is found that the object attribute of the Array object changes during the execution, a first target vulnerability corresponding to the abnormal change can be determined, that is, the type confusion vulnerability corresponding to the Array object is represented by the first target vulnerability. Therefore, the historical vulnerability data, object processing behavior, function method, and object attribute are used to construct the corresponding execution sample, describe the possible vulnerability characteristics, types, and possible influence factors of the target system, improve the concentration of the target in the vulnerability mining process, improve the mining efficiency, and enable the vulnerability mining to be concentrated on the Array object, simplify the mining process, and expand the accuracy and comprehensiveness of the mining. Based on the constructed execution sample, the universality and portability of the vulnerability mining can be improved, and the usability of the mined target vulnerability is ensured, so as to optimize the target system based on the target vulnerability and ensure the security of the system operation.

[0078] In some possible implementations, an inline cache can be included in the browser engine, which can be used to accelerate the access of object properties by JavaScript functions. The inline cache can dynamically generate efficient access code for specific objects and properties based on runtime property access, to avoid dynamic lookup every time the property is accessed, and improve the efficiency of property access.

[0079] During execution, the browser engine can obtain the number of executions of the function method, determine a target function method whose execution number reaches a preset threshold, then generate corresponding efficient access code for the target function method, and store the efficient access code in the inline cache. The efficient access code is used to access a target Array object and target object data of the target Array object to which the target function method belongs. Then, the target object data is added with a corresponding monomorphic marker, which is used to represent that the target Array object has only one determined object type according to the target object data at runtime. Then, the target Array object is run according to the target object data. If the object type of the target Array object changes during the running process, a first target vulnerability corresponding to the target Array object is determined. Thus, the inline cache is used to add a monomorphic marker representing a specific type to the Array object. If the Array object changes in type during execution, it can be determined that the optimized code may have incorrect behavior, that is, the Array object has a type confusion vulnerability, and a vulnerability corresponding to the Array object is determined.

[0080] Optionally, for the first target vulnerability, if the target Array object is modified to another object type or the target Array object is modified to another Array object during the running process, a first target vulnerability corresponding to the target Array object is determined.

[0081] It should be noted that in the browser engine, the inline cache is an optimization technique used to accelerate the access of object properties by JavaScript functions. The inline cache dynamically generates efficient access code for specific objects and properties based on runtime property access, to avoid dynamic lookup every time the property is accessed.

[0082] When a function is executed a certain number of times, the browser engine performs inline cache optimization on the properties of the object operated by the function. This means that the engine generates efficient access code based on the execution of the function and stores it in the inline cache. When the function is executed again, the engine directly uses the code in the inline cache without performing property lookup again.

[0083] During this optimization process, the browser engine will mark the accessed property as "MONOMORPHIC". This means that the property is considered monomorphic, i.e., it has only one definite type at runtime. By marking the property as MONOMORPHIC, the browser engine can generate more efficient access code without considering the possibility that the property might have multiple types.

[0084] This optimization can improve the performance of function execution, especially when repeatedly performing access operations on the same object property. Through inline caching and the MONOMORPHIC marker, the browser engine can avoid repeated property lookups and type judgments, thus speeding up the execution of the code.

[0085] Type confusion vulnerabilities are typically introduced due to the inline caching optimization feature of the browser engine. The essence of a type confusion vulnerability is that at runtime, the browser engine makes assumptions about the type of a property and generates corresponding optimized code. However, if inconsistent with the previously assumed property type occurs during subsequent execution, type confusion will occur.

[0086] Specifically, during function execution, the browser engine will generate specific access code based on the MONOMORPHIC marker of the property. These codes assume that the property has a specific type and have been optimized accordingly. However, if the type of the property changes during subsequent execution, such as being modified to a different type or a different object, the previously generated assumptions will no longer hold, and the optimized code may exhibit incorrect behavior. This type confusion vulnerability can be exploited to bypass type checks, perform unauthorized operations, or tamper with data. For example, it may be possible to modify the type of an object's property to make it mistakenly believed to be another object type, thereby bypassing access restrictions or executing malicious code.

[0087] It should be noted that the confusion exploitation commonly seen in the browser engine is to confuse the type between the string object and the Array object, and then modify the length of the Array array to realize the out-of-bound reading of the non-expected memory data. By taking advantage of the similar internal representation of the String object and the Array object in the V8 engine. In the browser engine, the String object and the Array object have a fixed data storage structure, which contains some meta information and data content. The representation of these objects in the memory is continuous and adjacent. Then, by converting a variable originally as a String object into an Array object, or converting a variable originally as an Array object into a String object, type confusion can be caused. Then, the length of the Array object is modified to be greater than the actually allocated memory space. In this way, when the variable is operated, the data in the memory location that should not be accessed can be read out of bound, so that by out-of-bound reading of the non-expected memory data, sensitive information can be obtained, or the data can be used to further develop other forms of attacks, such as address leak, code execution, etc.

[0088] For example, referring to Figure 2 , a schematic diagram of a data structure provided in an embodiment of the application is shown. For the Array object, the array length is 3, and after type confusion, the variable originally as an Array object can be converted into a String object, and then the Array length is modified to n. For the part of n-3, the data in the memory location that should not be accessed can be read out of bound, realizing the out-of-bound reading of the non-expected memory data, such as reading the binary data stored in the backing_store (underlying storage area) corresponding to the ArrayBuffer (such as reading permission R / W, etc.), the object properties stored in the Object, etc., so as to cause abnormal reading of data due to memory leak (leek).

[0089] In an example code, it is demonstrated how to use the type confusion vulnerability to modify other data:

[0090]

[0091]

[0092] In the above code example, first, a class named C is defined at the beginning of the code, which contains a method m. In the m method, super.prototype is accessed, which returns C._proto_.prototype.

[0093] Next, a function named f is defined.

[0094] Then, the prototype chain of the C class is modified to point to the f function by setting C.prototype._proto_ to f.

[0095] In the following code, an instance c of the C class is created and the c object is given some properties x0, x1, x2, x3 and x4.

[0096] The key part is that the type confusion is triggered at f.prototype.

[0097] The browser engine performs inline cache optimization for the properties of the objects operated by the function for a certain number of times, and marks the properties as MONOMORPHIC. This part of code causes the properties of f.prototype to become MEGAMORPHIC, which is related to the confusion path triggered by the code. This type of confusion can cause type hypothesis errors.

[0098] Finally, the type confusion vulnerability is triggered at the c.m() method call.

[0099] Through the above process, the target system can be effectively mined for type confusion-related vulnerabilities, so that the vulnerabilities related to the Array object can be handled, and the stability and security of the target system can be improved.

[0100] In addition, in the process of executing the execution example by the browser engine, in addition to the Array object, the browser engine itself can also be detected for vulnerabilities. If the state of the browser engine changes during execution (such as abnormal exit, running jam, etc.), a second target vulnerability corresponding to the browser engine is determined, which represents a running vulnerability of the browser engine itself, thereby enriching the types of vulnerability mining and improving the comprehensiveness of vulnerability mining.

[0101] Optionally, after the corresponding target vulnerability is mined through the above process, a demonstration script and an execution script for the target vulnerability mined from the target system can be obtained, and then the demonstration script can be executed to output the demonstration process corresponding to the target vulnerability, and / or the execution script can be executed to output the vulnerability behavior corresponding to the target vulnerability. Thus, by obtaining the corresponding demonstration script and execution script, the mined vulnerability can be reproduced so that users can view and analyze the specific reasons for the vulnerability, and then the vulnerability can be repaired in a targeted manner to ensure the security and stability of system operation.

[0102] It should be noted that the embodiments of the present application include but are not limited to the above examples, and it can be understood that those skilled in the art can set according to actual needs under the guidance of the idea of the embodiments of the present application, and the present application does not limit this.

[0103] In the embodiments of the present application, the browser engine can be applied, and in the process of vulnerability mining of the target system, the browser engine can obtain the Array object corresponding to the target system and the historical vulnerability data corresponding to the Array object, and obtain the object data corresponding to the Array object, the object data at least including object processing behavior, function method and object attribute, the Array object is an array object in the target system, then according to the historical vulnerability data, the object processing behavior, the function method and the object attribute, an execution sample for vulnerability mining of the target system is constructed, and then the execution sample is input into the browser engine for execution in response. If it is found that the object attribute corresponding to the Array object has changed abnormally during the execution process, a first target vulnerability corresponding to the abnormal change is determined, and the first target vulnerability represents a type confusion vulnerability corresponding to the Array object. The corresponding execution sample is constructed by the historical vulnerability data, the object processing behavior, the function method and the object attribute, which describes the possible vulnerability characteristics, types and possible influence factors of the target system, improves the concentration of the target in the vulnerability mining process, improves the mining efficiency, and makes the vulnerability mining concentrate on the Array object, simplifies the mining process, and at the same time, the accuracy and comprehensiveness of the mining are expanded by rich data. Based on the constructed execution sample, the universality and portability of vulnerability mining can be improved, and the usability of the mined target vulnerability is ensured, so as to optimize the target system based on the target vulnerability and ensure the safety of system running.

[0104] In order for those skilled in the art to better understand the technical solutions in the embodiments of the present application, the following will be exemplarily described by corresponding examples:

[0105] Reference Figure 3Fig. 1 shows a schematic diagram of a scenario of vulnerability mining provided in an embodiment of the present application. A corresponding vulnerability mining model can be constructed for corresponding prior knowledge, where the prior knowledge can be knowledge, belief or hypothesis that already exists before a user obtains new information, i.e. the vulnerability model is constructed by obtaining existing data. In a specific implementation, a corresponding vulnerability mining model can be constructed for an Array object in a target system, by obtaining corresponding object processing behaviors such as "addition, deletion, modification and query" of the Array object, loop traversal, complex logic, object methods, etc., and combining historical vulnerabilities, JS syntax library and other associated data, a corresponding vulnerability mining model is constructed. Through the vulnerability mining model, various different test cases can be abstracted and combined to generate various different test cases to cover various possible situations. These test cases can cover different inputs and scenarios to test the behavior and boundary conditions of the Array object.

[0106] When the test cases are generated, each test case can be translated and actual executable JavaScript code is generated. In this step, the abstract test case is converted into actual executable JavaScript code. Specifically, according to the operations and influence factors in the test case, corresponding JavaScript code is written, and then the JavaScript code is executed in the corresponding browser engine. The execution process can include recording crash vulnerabilities, outputting corresponding POC (Proof of Concept) code; outputting corresponding EXP (Exploit) code for length changes during execution; and outputting corresponding exception records for attribute changes.

[0107] All test code is executed by calling the browser engine. In this step, the browser engine is called, and the generated test code is passed to the engine for execution. Appropriate test environment and tools are used to ensure that the test code is executed in a controlled environment, and relevant execution results and log information are collected.

[0108] Record and observe the property changes of Array and the state of the browser engine. During the execution of the test code, the property changes of the Array object are recorded and observed, especially the changes related to type confusion. If it is found that the Array property has changed unexpectedly during execution, it indicates that there is a type confusion vulnerability. In addition, the state of the browser engine is also observed, especially the abnormal exit condition. If the engine exits abnormally, it may indicate that a vulnerability in the browser engine itself has been discovered, and it is highly likely to be exploited.

[0109] Through this process, type confusion vulnerabilities that may exist and vulnerabilities of the browser engine itself can be found and mined, thereby helping developers fix these security problems and improving the security of the browser and the engine. Moreover, the process avoids most technical difficulties in traditional vulnerability mining processes, making the mining target and mining process simpler and clearer, and the mining results more in line with expectations.

[0110] It should be noted that, for the method embodiments, in order to simply describe, they are all described as a series of action combinations, but those skilled in the art should know that the embodiments of the present application are not limited by the order of the described actions, because according to the embodiments of the present application, certain steps can be performed in other order or at the same time. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions involved are not necessarily necessary for the embodiments of the present application.

[0111] Referring to Figure 4 , a structural block diagram of a vulnerability mining device provided in the embodiments of the present application is shown, which is applied to a browser engine and can specifically include the following modules:

[0112] The data acquisition module 401 is configured to acquire an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and acquire object data corresponding to the Array object, the object data at least including object processing behavior, function devices and object attributes, and the Array object being an array object in the target system.

[0113] The sample construction module 402 is configured to construct an execution sample for vulnerability mining of the target system according to the historical vulnerability data, the object processing behavior, the function devices and the object attributes.

[0114] The first vulnerability mining module 403 is configured to, in response to inputting the execution sample into the browser engine for execution, if an abnormal change of an object attribute corresponding to the Array object is found in the execution process, determine a first target vulnerability corresponding to the abnormal change, and the first target vulnerability represents a type confusion vulnerability corresponding to the Array object.

[0115] In some feasible implementation manners, further comprising:

[0116] The second vulnerability mining module is configured to, if a state of the browser engine is changed in the execution process, determine a second target vulnerability corresponding to the browser engine, and the second target vulnerability represents a running vulnerability of the browser engine itself.

[0117] In some feasible implementation manners, the sample construction module 402 is specifically configured to:

[0118] combining and mutating the historical vulnerability data, the object processing behavior, the function device and the object data to generate a test sample for the target system;

[0119] converting the test sample into an execution sample for execution in the browser engine.

[0120] In some possible implementation manners, the sample construction module 402 is specifically configured to:

[0121] convert the test sample into JavaScript code for execution in the browser engine.

[0122] In some possible implementation manners, the browser engine at least includes an inline cache, and the first vulnerability mining module 403 is specifically configured to:

[0123] in response to inputting the execution sample into the browser engine for execution, obtaining an execution frequency of the function device in the execution process, and determining a target function device whose execution frequency reaches a preset threshold;

[0124] generating a corresponding valid access code for the target function device, and storing the valid access code into the inline cache, the valid access code being used to access a target Array object to which the target function device belongs and target object data of the target Array object;

[0125] adding a corresponding monomorphic marker to the target object data, the monomorphic marker being used to represent that the target Array object has only one determined object type when running according to the target object data;

[0126] in response to running the target Array object according to the target object data, if an object type of the target Array object changes in the running process, determining a first target vulnerability corresponding to the target Array object.

[0127] In some possible implementation manners, the first vulnerability mining module 403 is specifically configured to:

[0128] if the target Array object is modified into another object type or the target Array object is modified into another Array object in the running process, determining a first target vulnerability corresponding to the target Array object.

[0129] In some possible implementation manners, the method further includes:

[0130] The script obtaining module is configured to obtain a demonstration script and an execution script for the target vulnerability obtained by mining the target system.

[0131] The first script execution module is configured to execute the demonstration script and output a demonstration process corresponding to the target vulnerability.

[0132] The second script execution module is configured to execute the execution script and output a vulnerability behavior corresponding to the target vulnerability.

[0133] For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the related parts refer to the part of the method embodiment.

[0134] In addition, the embodiment of the present application further provides an electronic device, which comprises a processor, a memory, a computer program stored in the memory and executable on the processor, and the computer program implements each process of the vulnerability mining method embodiment of the present application when executed by the processor, and achieves the same technical effect. To avoid repetition, it will not be repeated here.

[0135] The embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium stores a computer program, and the computer program implements each process of the vulnerability mining method embodiment of the present application when executed by the processor, and achieves the same technical effect. To avoid repetition, it will not be repeated here. The computer readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0136] Figure 5 A hardware structure schematic diagram of an electronic device for implementing various embodiments of the present application.

[0137] The electronic device 500 includes but is not limited to a radio frequency unit 501, a network module 502, an audio output unit 503, an input unit 504, a sensor 505, a display unit 506, a user input unit 507, an interface unit 508, a memory 509, a processor 510, and a power supply 511, etc. Those skilled in the art can understand that the electronic device structure involved in the embodiments of the present application does not constitute a limitation on the electronic device, and the electronic device can include more or fewer components than the illustration, or combine certain components, or different component arrangements. In the embodiments of the present application, the electronic device includes but is not limited to a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle terminal, a wearable device, and a pedometer, etc.

[0138] It should be understood that in the embodiments of the present application, the radio frequency unit 501 can be used for receiving and sending signals in the process of transmitting information or calling. Specifically, after receiving the downlink data from the base station, the radio frequency unit 501 processes the data for the processor 510. In addition, the radio frequency unit 501 sends the uplink data to the base station. Generally, the radio frequency unit 501 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 501 can also communicate with the network and other devices through a wireless communication system.

[0139] The electronic device provides the user with wireless broadband Internet access through the network module 502, such as helping the user to send and receive emails, browse web pages, and access streaming media, etc.

[0140] The audio output unit 503 can convert audio data received by the radio frequency unit 501 or the network module 502 or stored in the memory 509 into an audio signal and output as sound. Moreover, the audio output unit 503 can also provide audio output related to a specific function performed by the electronic device 500 (e.g., a call signal reception sound, a message reception sound, etc.). The audio output unit 503 includes a speaker, a buzzer, a receiver, etc.

[0141] The input unit 504 is used to receive audio or video signals. The input unit 504 can include a graphics processor (GPU) 5041 and a microphone 5042. The graphics processor 5041 processes image data of a still picture or a video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode. The processed image frame can be displayed on the display unit 506. The image frame processed by the graphics processor 5041 can be stored in the memory 509 (or other storage medium) or transmitted via the radio frequency unit 501 or the network module 502. The microphone 5042 can receive sound and can process such sound into audio data. The processed audio data can be converted into a format that can be transmitted to a mobile communication base station via the radio frequency unit 501 in the case of a telephone call mode.

[0142] The electronic device 500 further includes at least one sensor 505, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 5061 according to the brightness of ambient light, and the proximity sensor can turn off the display panel 5061 and / or the backlight when the electronic device 500 is moved to the ear. As one of the motion sensors, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and when at rest, can detect the magnitude and direction of gravity, and can be used to identify the electronic device posture (such as screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, knocking), and the like. The sensor 505 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, and the like, which will not be described here.

[0143] The display unit 506 is used to display information input by the user or information provided to the user. The display unit 506 can include a display panel 5061, which can be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), and the like.

[0144] The user input unit 507 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 507 includes a touch panel 5071 and other input devices 5072. The touch panel 5071, also known as a touch screen, can collect user touch operations (such as user operations using a finger, a stylus, or any suitable object or accessory on or near the touch panel 5071) on or near it. The touch panel 5071 can include two parts, a touch detection device and a touch controller. The touch detection device detects the user's touch position and detects the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, and converts it into touch coordinates, and sends it to the processor 510, receives commands from the processor 510 and executes them. In addition, the touch panel 5071 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 5071, the user input unit 507 can also include other input devices 5072. Specifically, the other input devices 5072 can include, but are not limited to, a physical keyboard, function keys (such as volume control buttons, on-off buttons, etc.), trackballs, mice, joysticks, and the like, which will not be described here.

[0145] Further, the touch panel 5071 can be overlaid on the display panel 5061, and when the touch panel 5071 detects a touch operation thereon or nearby, it transmits to the processor 510 to determine the type of touch event, and then the processor 510 provides corresponding visual output on the display panel 5061 according to the type of touch event. It can be understood that, in an embodiment, the touch panel 5071 and the display panel 5061 are implemented as two independent components to realize the input and output functions of the electronic device, but in some embodiments, the touch panel 5071 and the display panel 5061 can be integrated to realize the input and output functions of the electronic device, which is not limited here.

[0146] The interface unit 508 is an interface for connecting external devices to the electronic device 500. For example, the external devices can include a wired or wireless headset port, an external power (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device having an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, and the like. The interface unit 508 can be used to receive input (e.g., data information, power, and the like) from external devices and transmit the received input to one or more elements within the electronic device 500 or can be used to transmit data between the electronic device 500 and external devices.

[0147] The memory 509 can be used to store software programs and various data. The memory 509 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs (such as a sound playing function, an image playing function, etc.) required by at least one function, and the like; the data storage area can store data (such as audio data, a phone book, etc.) created according to the use of the mobile phone, and the like. In addition, the memory 509 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other volatile solid-state memory device.

[0148] The processor 510 is the control center of the electronic device, connects all parts of the electronic device through various interfaces and lines, executes various functions of the electronic device and processes data by running or executing software programs and / or modules stored in the memory 509 and calling data stored in the memory 509, and thus monitors the entire electronic device. The processor 510 can include one or more processing units; preferably, the processor 510 can integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, the user interface, and the application program, and the modem processor mainly processes wireless communication. It can be understood that the above-mentioned modem processor can also not be integrated into the processor 510.

[0149] The electronic device 500 can further include a power supply 511 (such as a battery) that supplies power to each of the components. Preferably, the power supply 511 is logically connected to the processor 510 through a power management system, so that the power management system can manage charging, discharging, and power consumption management, etc.

[0150] In addition, the electronic device 500 includes some functional modules that are not shown here and will not be described again.

[0151] It should be noted that in this document, the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device that includes a list of elements not only includes those elements, but also includes other elements not explicitly listed, or inherent to such a process, method, article, or device. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or device that includes the element.

[0152] From the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for making a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) execute the methods described in various embodiments of the present application.

[0153] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific embodiments, which are only illustrative and not limiting. Those skilled in the art can make many forms under the inspiration of the present application without departing from the purpose of the present application and the scope protected by the claims, which are all within the protection of the present application.

[0154] Those skilled in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the embodiments of the present application can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are executed in hardware or software depends on the specific application and design constraints of the technical solutions. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0155] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, and will not be described here.

[0156] In the embodiments provided by the present application, it should be understood that the disclosed device and method can be implemented in other ways. For example, the device embodiments described above are only schematic. The division of the units is only a logical function division. There can be another division manner in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0157] The units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, that is, can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0158] In addition, each functional unit in the various embodiments of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit.

[0159] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The foregoing storage medium includes: U disk, mobile hard disk, ROM, RAM, magnetic disk or optical disk, and various program codes that can be stored in the medium.

[0160] The above describes only the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of exploiting a vulnerability, characterized by, Applied to a browser engine, comprising: obtaining an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and obtaining object data corresponding to the Array object, the object data at least including object processing behavior, function method and object attribute, the Array object being an array object in the target system; constructing an execution example for vulnerability mining of the target system according to the historical vulnerability data, the object processing behavior, the function method and the object attribute; the browser engine at least includes an inline cache; in response to inputting the execution example into the browser engine for execution, obtaining the execution times of the function method in the execution process, and determining a target function method whose execution times reach a preset threshold; generating a corresponding effective access code for the target function method, and storing the effective access code into the inline cache, the effective access code being used to access a target Array object to which the target function method belongs and target object data of the target Array object; adding a corresponding monomorphic marker to the target object data, the monomorphic marker being used to represent that there is only one determined object type when the target Array object runs according to the target object data; in response to running the target Array object according to the target object data, if the object type of the target Array object changes in the running process, a first target vulnerability corresponding to the target Array object is determined, the first target vulnerability representing a type confusion vulnerability corresponding to the Array object.

2. The method of claim 1, wherein, Further comprising: if the state of the browser engine changes in the execution process, a second target vulnerability corresponding to the browser engine is determined, the second target vulnerability representing a running vulnerability of the browser engine itself.

3. The method according to claim 1 or 2, characterized in that, The execution example for vulnerability mining of the target system is constructed according to the historical vulnerability data, the object processing behavior, the function method and the object attribute, comprising: combining and mutating the historical vulnerability data, the object processing behavior, the function method and the object data to generate a test example for the target system; converting the test example into an execution example for execution in the browser engine.

4. The method of claim 3, wherein, The test example is converted into a JavaScript code for execution in the browser engine. If the object type of the target Array object changes in the running process, a first target vulnerability corresponding to the target Array object is determined, comprising:

5. The method of claim 1, wherein, if the target Array object is modified into another object type or the target Array object is modified into another Array object in the running process, a first target vulnerability corresponding to the target Array object is determined. Further comprising:

6. The method of claim 1, wherein, obtaining a demonstration script and an execution script for a target vulnerability mined from the target system; ​ execute the demonstration script to output a demonstration process corresponding to the target vulnerability; and / or, execute the execution script to output a vulnerability behavior corresponding to the target vulnerability.

7. A vulnerability exploitation apparatus characterized by comprising: Applied to a browser engine, comprising: a data acquisition module, configured to acquire an Array object corresponding to a target system and historical vulnerability data corresponding to the Array object, and acquire object data corresponding to the Array object, the object data at least including object processing behavior, function device, and object attribute, the Array object being an array object in the target system; a sample construction module, configured to construct an execution sample for vulnerability mining of the target system according to the historical vulnerability data, the object processing behavior, the function device, and the object attribute; a first vulnerability mining module, configured to, in response to inputting the execution sample into the browser engine for execution, determine a first target vulnerability corresponding to an abnormal change of an object attribute of an Array object if the abnormal change of the object attribute of the Array object is found in the execution process, the first target vulnerability representing a type confusion vulnerability corresponding to the Array object; the browser engine at least including an inline cache, and the first vulnerability mining module is specifically configured to: in response to inputting the execution sample into the browser engine for execution, acquire an execution frequency of the function device in the execution process, and determine a target function device whose execution frequency reaches a preset threshold; generate an effective access code corresponding to the target function device, and store the effective access code into the inline cache, the effective access code being used to access a target Array object to which the target function device belongs and target object data of the target Array object; add a monomorphism mark corresponding to the target object data, the monomorphism mark being used to represent that the target Array object has only one determined object type when running according to the target object data; in response to running the target Array object according to the target object data, determine a first target vulnerability corresponding to the target Array object if an object type of the target Array object changes in the running process.

8. An electronic device, comprising: comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory complete communication with each other through the communication bus; the memory is used to store a computer program; the processor is used to execute the program stored on the memory, and implement the method in any one of claims 1-6. 9.A computer readable storage medium having instructions stored thereon, the instructions, when executed by one or more processors, cause the processors to perform the method in any one of claims 1-6.

Images