Method and system for detecting unauthorized vulnerabilities of Java Web system

Abstract

The invention relates to the field of computer network security, in particular to an unauthorized vulnerability detection method and system of a Java Web system. The invention provides a method for detecting an unauthorized vulnerability of a Java Web system. The method comprises the following steps of: obtaining a to-be-detected code of a Java Web application; the code to be detected is converted into JIMPLE IR through a Soot framework; obtaining each authentication correlation function and each sensitive function in the code to be detected based on a prior rule base and the JIMPLE IR; based on whether the function call point of each authentication related function can reach one or more sensitive functions, obtaining each authentication outlet of the authentication related function; and analyzing the authentication path of each authentication exit structure to detect whether an unauthorized vulnerability exists. According to the method and the device, the authentication logic code with defects in the API can be detected instead of staying at a configuration level. And meanwhile, by introducing the inference capability of the large language model, deeper and more complex unauthorized vulnerabilities can be detected.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a method and system for detecting unauthorized vulnerabilities of a Java Web system. Background Art

[0003] An unauthorized access vulnerability refers to a vulnerability in the access control policy of a Web application, which is designed to restrict users from performing operations beyond their intended permissions. Incorrect access control can lead to information leakage, data modification and destruction, command execution, and other consequences, causing serious harm. According to the Top 10 security vulnerabilities published by OWASP (Open Web Application Security Project) in 2022, from 2017 to 2021, the number of incorrect access control vulnerabilities rose from fifth to first, and is widely present in Web applications.

[0004] The harm caused by the unauthorized vulnerabilities is so huge and the number is so large that it is difficult to ignore. At the same time, JAVA WEB systems are widely present in the network space. Therefore, it is necessary to study the unauthorized vulnerability detection method for Java Web API. Summary of the invention

[0005] In view of the above problems, the present invention proposes a method and system for detecting unauthorized vulnerabilities in a Java Web system, which detects unauthorized vulnerabilities in application APIs based on white-box static analysis technology.

[0006] On one hand, the present invention provides a method for detecting unauthorized vulnerabilities in a Java Web system, the steps of which include:

[0007] Get the Java Web application code to be tested;

[0008] Using the Soot framework to convert the code to be tested into JIMPLE IR;

[0009] Obtaining each authentication-related function and each sensitive function in the code to be detected based on the prior rule base and the JIMPLE IR;

[0010] Based on whether the function call point of each authentication-related function can reach one or more sensitive functions, each authentication exit of the authentication-related function is obtained;

[0011] Analyze the authentication path of each authentication export structure to detect whether there is an unauthorized vulnerability.

[0012] Furthermore, the a priori rule library includes an authentication-related function library, which stores interfaces and annotation feature information of various authentication-related functions; and a sensitive function library, which stores class names, function names and parameter list information of various sensitive functions.

[0013] Furthermore, the unauthorized access vulnerability includes three types: unauthenticated, weakly authenticated and missing authentication. Unauthenticated refers to the existence of an authentication path in the code structure that passes through several authentication-irrelevant structures and reaches the authentication exit without passing through any authentication-related structure; weakly authenticated refers to the existence of an authentication path in the code structure that passes through several authentication-related structures before reaching the authentication exit structure, but the several authentication-related structures include one or more weak authentication structures; missing authentication refers to the existence of two different authentication paths in the code structure that reach the same authentication exit structure.

[0014] Furthermore, the code to be detected includes JAVA JAR package, Class class and War package.

[0015] Furthermore, for any authentication-related function, the SOOT framework is used to extract the function call points in the authentication-related function, and the graph path search algorithm is used to track whether the call path can reach one or more sensitive functions to obtain the authentication exits inside the authentication-related function.

[0016] Furthermore, for any authentication-related function, traverse the statements in its JIMPLE IR, extract the conditionExpr expression in the IFstmt class statement code, and trace the source function of its parameters. If the source function is not a suspected authentication function based on prior knowledge, directly determine its authentication type; otherwise, generate its authentication export structure and perform subsequent unauthorized vulnerability detection.

[0017] Furthermore, if it is impossible to judge based on prior knowledge, a large language model is used to determine whether the source function is a suspected authentication function.

[0018] Another aspect of the present invention provides a Java Web system unauthorized vulnerability detection system, comprising:

[0019] The data acquisition module is used to obtain the Java Web application code to be detected;

[0020] A data parsing module is used to convert the code to be detected into JIMPLE IR using the Soot framework; obtain each authentication-related function and each sensitive function in the code to be detected based on the prior rule base and the JIMPLE IR; and obtain each authentication exit of the authentication-related function based on whether the function call point of each authentication-related function can reach one or more sensitive functions;

[0021] The vulnerability detection module is used to analyze the authentication path of each authentication export structure to detect whether there is an unauthorized vulnerability.

[0022] The present invention also provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing any of the above methods.

[0023] The present invention also provides a storage medium storing a computer program, wherein when the computer program is executed by a computer, any of the above-mentioned methods is implemented.

[0024] The beneficial effects of the present invention are as follows:

[0025] Aiming at the current situation that JAVA WEB unauthorized access problems are widely present in cyberspace and are highly harmful. Based on an in-depth analysis of the principle of unauthorized access vulnerability generation, the present invention designs an unauthorized access vulnerability detection framework for Java Web, provides security detection services for developers and security testers, and improves application security. Moreover, the authentication logic code with defects inside Java Web can be detected, rather than just staying at the configuration level. At the same time, by introducing the reasoning ability of a large language model, deeper and more complex unauthorized access vulnerabilities can be detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a flow chart of the first aspect of a specific implementation of the present invention.

[0027] Figure 2 Schematic diagram of three unauthorized models in a specific implementation manner of the present invention.

[0028] Figure 3 It is a structural block diagram of the unauthorized vulnerability detection system in a specific implementation manner of the present invention. DETAILED DESCRIPTION

[0029] The present invention is further described in detail below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit it.

[0030] The first aspect of the specific implementation of the present invention discloses a method for detecting unauthorized vulnerabilities in a Java Web system. The specific process is as follows: Figure 1 shown.

[0031] S1 obtains the code to be detected

[0032] Obtain the Java Web application source code package, including the JAVA JAR package, Class class, and War package, and obtain the code to be tested from it.

[0033] S2 converts JIMPLE IR

[0034] Use the SOOT framework to convert the JIMPLE IR of the code to be tested.

[0035] S3 obtains or builds a priori rule base

[0036] By analyzing the JAVA Web development specifications, manually summarizing the interfaces and annotation features of authentication-related functions, abstracting them into rules, and building an authentication-related function library based on prior rules; of course, you can also directly use the existing authentication-related function library.

[0037] By collecting sensitive functions in JAVA syntax, including command execution related classes, SQL operation classes, file reading and writing classes, jndi query classes, etc., we manually summarize the class name, function name, parameter list and other information of sensitive functions to build a sensitive function library based on prior information.

[0038] S4 Marking Target Function and Sink Function

[0039] The SOOT framework is used to extract class information from the code to be detected. During the extraction process, the information in the two function libraries in S3 is used for matching, and the successfully matched functions are recorded as Target function and Sink function respectively.

[0040] S5 token auth_out structure

[0041] By analyzing JIMPLE IR, a function call graph CFG of the code to be analyzed is created. The function call point in the Target function is extracted using the SOOT framework, and the function call point is used as the starting point of the call graph CFG. Based on the graph path search algorithm, the call path is tracked to see whether it can reach the Sink function, thereby marking the sink call logic point inside the Target function and obtaining the auth_out structure.

[0042] S6 builds an over-authority model

[0043] Establish three unauthorized models in JAVA WEB API, including unauthenticated, weakly authenticated, and missing authentication. Figure 2 shown.

[0044] No auth: The program structure passes through several authentication-independent structures and does not pass through any authentication-related structure to reach the authentication exit. This is an unauthenticated unauthorized model.

[0045] Weak authentication: The program structure passes through several authentication-related structures before reaching the authentication exit structure, but there are one or more weak authentication structures among them, which is a weak authentication overreach model.

[0046] Missing authentication (miss auth): There are two authentication paths in the program structure that reach the same authentication exit structure, one of which passes through authentication structure ABC and the other passes through authentication structure AC. This is a missing authentication overreach model.

[0047] Among them, authentication-irrelevant structures are several code features in the program, including IF structures whose judgment conditions are irrelevant to permission verification, IF structures without auth_out structures inside, and any number of consecutive non-auth_out structure statement blocks. Authentication-related structures are several code features in the program, including IF structures with auth_out structures inside, and IF structures with return statements inside. Weak authentication structures are authentication-related structures with flawed judgment conditions.

[0048] S7 detects privilege escalation vulnerability

[0049] Traverse the statements in JIMPLE IR and determine whether the statement type is IFstmt. If not, skip it. If it is IFstmt, continue to analyze. By extracting the conditionExpr expression of IFstmt, trace the source function of its parameters, and directly determine the authentication type of the function based on the existing authentication rule library (and the authentication type of the source function has been collected in the existing authentication rule library and can be directly queried) and output it. If it cannot be determined, use the large language model to determine whether it is a suspected authentication function. If so, use the large language model to extract its auth_out structure and add it to the queue to be analyzed.

[0050] Traverse the auth_out structure of the queue to be analyzed, match it from the three unauthorized models according to the current authentication path, and determine whether there is an unauthorized vulnerability based on the matching results and output it.

[0051] The second aspect of the specific implementation of the present invention discloses a Java Web system unauthorized vulnerability detection system, such as Figure 3 shown.

[0052] The data acquisition module is used to obtain the Java Web application code to be detected;

[0053] A data parsing module is used to convert the code to be detected into JIMPLE IR using the Soot framework; obtain each authentication-related function and each sensitive function in the code to be detected based on the prior rule base and the JIMPLE IR; and obtain each authentication exit of the authentication-related function based on whether the function call point of each authentication-related function can reach one or more sensitive functions;

[0054] The vulnerability detection module is used to analyze the authentication path of each authentication export structure to detect whether there is an unauthorized vulnerability.

[0055] The third aspect of the specific implementation of the present invention discloses an embodiment of the method of the present invention, and illustrates it by taking the detection process of the CVE-2024-27764JEEWMS unauthorized vulnerability as an example.

[0056] [S1] Get the war package jeewms.war compiled from the jeewms source code, which is a total of 141.8MB in size.

[0057] [S2] Use the SOOT framework to convert the JIMPLE IR of jeewms.war.

[0058] [S3] Build authentication related function library and sensitive function library.

[0059] [S4] Using the SOOT framework, the class information of jeewms.war is extracted. When extracting information about the class org.jeecgframework.core.interceptors.AuthInterceptor, the rule information of the above-mentioned authentication-related function library is matched (the class implements the org.springframework.web.servlet.HandlerInterceptor interface), and its preHandle function is marked as the target function.

[0060] [S5] Analyze the marked preHandle function JIMPLE IR, perform graph path search on CFG, and mark the auth_out structure return 1.

[0061] [S6] Establish three unauthorized models existing in JAVA WEB API.

[0062] [S7] Traverse the JIMPLE IR of the org.jeecgframework.core.interceptors.AuthInterceptorpreHanlde function, run to the first JIFSTMT, trace its ConditionExpr function to java.lang.String:int length, hit the irrelevant function rule in the existing authentication rule library, and mark it as an authentication irrelevant structure. Run to the second JIFSTMT, trace its ConditionExpr function to java.lang.String:booleanequals(java.lang.Object), hit the weak authentication function rule in the existing authentication rule library, and mark it as a weak authentication structure. When running to return 1, hit the marked auth_out structure, output the authentication path status at this time as passing through a weak_auth authentication structure, judge that there is an unauthorized vulnerability, and output it.

[0063] The present invention is further experimentally compared with the prior art in the specific implementation manner. The method of the present invention is compared with the former mainstream commercial static analysis tool Fortify SCA 20.2.2.0003 version.

[0064] The test set is CVE-2023-41578, CVE-2023-6307, CVE-2023-34660, CVE-2023-34659, CVE-2023-41599, CVE-2022-27960, CVE-2018-20094, CVE-2022-28945, CVE-2018-18434.

[0065] The result is that the present invention detects all these historical unauthorized vulnerability CVEs, while Fortify does not detect them. The result shows that the present invention has better functions than the prior art.

[0066] The above implementation modes are only used to illustrate the technical solutions of the present invention rather than to limit the same. A person skilled in the art may modify or make equivalent substitutions for the technical solutions of the present invention without departing from the spirit and scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. A method for detecting an unauthorized vulnerability in a Java Web system, comprising the following steps: Get the Java Web application code to be tested; Using the Soot framework to convert the code to be tested into JIMPLE IR; Obtaining each authentication-related function and each sensitive function in the code to be detected based on the prior rule base and the JIMPLE IR; Based on whether the function call point of each authentication-related function can reach one or more sensitive functions, each authentication exit of the authentication-related function is obtained; Analyze the authentication path of each authentication export structure to detect whether there is an unauthorized vulnerability.

2. The method for detecting unauthorized vulnerabilities in a Java Web system according to claim 1, characterized in that: The prior rule library includes an authentication-related function library, which stores interfaces and annotation feature information of various authentication-related functions; And the sensitive function library stores the class name, function name and parameter list information of various sensitive functions.

3. The method for detecting unauthorized vulnerabilities in a Java Web system according to claim 1, characterized in that: The unauthorized access vulnerability includes three types: unauthenticated, weakly authenticated and missing authentication. Unauthenticated means that there is an authentication path in the code structure that passes through several authentication-irrelevant structures and reaches the authentication exit without passing through any authentication-related structure; weakly authenticated means that there is an authentication path in the code structure that passes through several authentication-related structures before reaching the authentication exit structure, but the several authentication-related structures include one or more weak authentication structures; missing authentication means that there are two different authentication paths in the code structure that reach the same authentication exit structure.

4. The method for detecting unauthorized vulnerabilities in a Java Web system according to claim 1, characterized in that: The code to be detected includes JAVAJAR package, Class class and War package.

5. The method for detecting unauthorized vulnerabilities in a Java Web system according to any one of claims 1 to 4, characterized in that: For any authentication-related function, the SOOT framework is used to extract the function call points in the authentication-related function, and the graph path search algorithm is used to track whether the call path can reach one or more sensitive functions to obtain the authentication exits inside the authentication-related function.

6. The method for detecting unauthorized vulnerabilities in a Java Web system according to claim 5, characterized in that: For any authentication-related function, traverse the statements in its JIMPLE IR, extract the conditionExpr expression in the IFstmt class statement code, and trace the source function of its parameters. If the source function is not a suspected authentication function based on prior knowledge, directly determine its authentication type; Otherwise, generate its authentication export structure and perform subsequent unauthorized vulnerability detection.

7. The method for detecting unauthorized vulnerabilities in a Java Web system according to claim 6, characterized in that: If it is not possible to judge based on prior knowledge, a large language model is used to determine whether the source function is a suspected authentication function.

8. A Java Web system unauthorized vulnerability detection system, comprising: The data acquisition module is used to obtain the Java Web application code to be detected; A data parsing module is used to convert the code to be detected into JIMPLE IR using the Soot framework; obtain each authentication-related function and each sensitive function in the code to be detected based on the prior rule base and the JIMPLE IR; and obtain each authentication exit of the authentication-related function based on whether the function call point of each authentication-related function can reach one or more sensitive functions; The vulnerability detection module is used to analyze the authentication path of each authentication export structure to detect whether there is an unauthorized vulnerability.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 8.

10. A storage medium storing a computer program, wherein when the computer program is executed by a computer, the method according to any one of claims 1 to 8 is implemented.

Images