Automatic Java Spring SQL / SSRF vulnerability mining method based on parameter flow simulation

Abstract

The invention relates to the field of computer security, and provides a Java Spring SQL / SSRF vulnerability automatic mining method based on parameter flow simulation, comprising the following steps: S1, analyzing a class file compiled by a source project in a JAR packet to be mined, traversing the class file in the Jar packet, and extracting an input parameter of a Mapping method subordinate to a controller as a start point of taint analysis as a source of taint propagation; and vulnerability link detection is carried out based on a method set S-1, an SQL injection vulnerability taint function set S-2 and an SSRF taint function set S-3 which are propagated by a method parameter in a single step. The method aims at solving the problem that an existing static analysis tool is insufficient in accuracy and coverage rate in recognizing SQL / SSRF vulnerabilities in a Java Spring framework, and has the advantages of being efficient, accurate, high in coverage degree and the like.

Claims

1. Java Spring SQL / SSRF vulnerability automatic mining method based on parameter flow simulation, characterized in that: The following steps are involved: S1. Parse the class files compiled from the source project in the JAR package to be mined, extract the relevant information of the class and its methods, obtain the interface implementation information, including: class name, parent class name, annotation type, whether it is an interface and class inheritance or interface implementation relationship, and save it in the data structure ClassRef; The ClassRef is stored in a key-value pair data structure ClassRef Map, where the key is the fully qualified name of the class and the value is the ClassRef instance corresponding to the class; Traverse the interface implementation information of each ClassRef instance in the ClassRef Map, establish a mapping from interface to implementation class, and locate the corresponding relationship between method implementation and call in Spring; S2. Use the class method call instruction observation tool in the ASM framework to analyze the methods in each class, build a Map data structure M1 to save the call relationship between methods; optimize M1 through the inverse topological sorting algorithm to obtain the optimized method list L1; S3. Traverse the class files in the Jar package and use the ASM framework to analyze the classes annotated with @Controller and @RestController. Extract the input parameters of the Mapping method under the corresponding controller as the starting point of the taint analysis and the source of taint propagation. S4. Build a command interpreter T1, analyze each method in the method list L1 one by one, dynamically simulate the Java virtual machine JVM bytecode instructions of the method, cause changes in the local variable table and operand stack, track the propagation of parameters within the method, and obtain the method set S-1 to which the method parameters are propagated in a single step, providing parameter propagation information for vulnerability analysis; S5. Construct SQL injection vulnerability tainted function set S-2, which includes common tainted functions in the SQL injection field; When a dynamic framework is used in the project, the dynamic framework behavior is simulated to assist in the dynamic identification of tainted functions. If a tainted function is identified, it is added to the SQL injection vulnerability tainted function set S-2; S6. Construct SSRF tainted function set S-3; By analyzing the bytecode features of the Java standard network library and HTTP client, a feature library of high-risk SSRF methods is established; When it is detected that the user input calling method matches the feature library, the method is added to the SSRF tainted function set S-3; Vulnerability link detection is performed based on the source of taint propagation obtained in step S3, the method set S-1 to which the method parameters are propagated in a single step, the SQL injection vulnerability taint function set S-2, and the SSRF taint function set S-3.

2. The Java Spring SQL / SSRF vulnerability automatic mining method based on parameter flow simulation as claimed in claim 1 is characterized in that: In S1, the ClassReader class in the ASM framework is used to parse the class files compiled from the source project in the JAR package to be mined.

3. The Java Spring SQL / SSRF vulnerability automatic mining method based on parameter flow simulation as claimed in claim 1 is characterized in that: In S3, The Mapping method is a method in the Spring framework that maps HTTP requests to specific controllers. The extracting of the input parameters of the subordinate Mapping methods in the relevant Controller specifically includes: extracting @GetMapping, @RequestMapping, and @PostMapping annotations in the corresponding controller Controller, traversing all the Mapping methods indicated by the annotations according to the annotations, and then extracting the input parameters of all the Mapping methods.

4. The Java Spring SQL / SSRF vulnerability automatic mining method based on parameter flow simulation as claimed in claim 1 is characterized in that: In S4, The dynamic simulation method specifically includes: Use command interpreter T1 to simulate the JVM bytecode instructions of the method and modify the operand stack and local variable table accordingly; The JVM bytecode instructions specifically include the following instructions: ILOAD, ASTORE, INVOKESPECIAL, and DUP.

5. The Java Spring SQL / SSRF vulnerability automatic mining method based on parameter flow simulation as claimed in claim 1 is characterized in that: In S5, The general tainted functions include: org.springframework.jdbc.core.JdbcTemplate.query, java.sql.Statement.executeQuery, org.springframework.jdbc.core.JdbcTemplate.execute; The dynamic framework includes: MyBatis; The method of assisting in the dynamic identification of tainted functions by simulating dynamic framework behaviors specifically includes: scanning MyBatis annotations and Mapper XML configuration files, analyzing whether the SQL statements in the XML contain user input data, and dynamically determining whether to add to the tainted function set.

6. The Java Spring SQL / SSRF vulnerability automatic mining method based on parameter flow simulation as claimed in claim 1 is characterized in that: In S6, the Java standard network library includes java.net.URL and java.net.HttpURLConnection; the HTTP client includes Apache HttpClient and SpringRestTemplate.

7. The Java Spring SQL / SSRF vulnerability automatic mining method based on parameter flow simulation as claimed in claim 1 is characterized in that: In S6, the vulnerability link detection is performed based on the source of the taint propagation obtained in step S3, the method set S-1 to which the method parameters are propagated in a single step, the SQL injection vulnerability taint function set S-2, and the SSRF taint function set S-3, specifically including: First, set the input parameter of the Mapping method in step S3 to the taint, and traverse the methods in the method set S-1 propagated to by the method parameter in a single step. If the method in the traversed set S-1 is in the set S-2 and the set S-3, the current link is marked as a vulnerable link. Otherwise, the taint is continued to be propagated to the next round of methods based on the set S-1 until the preset maximum depth is exceeded. If the tainted function is propagated to the set S-2 and the set S-3 before the maximum depth is reached, the propagation is stopped and the propagation path is marked as a vulnerable link.

8. The Java Spring SQL / SSRF vulnerability automatic mining method based on parameter flow simulation as claimed in claim 7 is characterized in that: In S6, the vulnerability link detection further includes: outputting the vulnerability path based on the vulnerability link to complete SQL injection / SSRF vulnerability mining.

Images