An Automated Method for Discovering Java Spring SQL / SSRF Vulnerabilities Based on Parameter Flow Simulation

CN120217378BActive Publication Date: 2026-05-26HANGZHOU DIANZI UNIV
View PDF 0 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
HANGZHOU DIANZI UNIV
Filing Date
2025-03-07
Publication Date
2026-05-26

AI Technical Summary

Technical Problem

Existing static analysis tools lack accuracy and coverage in identifying SQL/SSRF vulnerabilities in the Java Spring framework, and struggle to handle complex and dynamic framework features, resulting in incomplete and inaccurate vulnerability detection.

Method used

This paper adopts an automated Java Spring SQL/SSRF vulnerability discovery method based on parameter flow simulation. Combining the characteristics of the Spring framework, it uses dynamic and static code hybrid analysis technology to parse class files in JAR packages, extract relevant information about classes and their methods, construct method call relationships, simulate Java Virtual Machine bytecode instructions of methods, trace parameter propagation, generate a set of tainted functions, and detect vulnerability chains.

Benefits of technology

It improves the efficiency and accuracy of vulnerability detection, increases the coverage of vulnerability detection, and can more efficiently and accurately identify SQL injection and SSRF vulnerabilities, adapting to complex Java Spring projects.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN120217378B_ABST
    Figure CN120217378B_ABST
Patent Text Reader

Abstract

This invention relates to the field of computer security and proposes an automated method for discovering Java Spring SQL / SSRF vulnerabilities based on parameter flow simulation. The method includes the following steps: S1, parsing the class files compiled from the source project in the JAR package to be discovered, traversing the class files in the JAR package, and extracting the input parameters of the Mapping methods under the Controller as the starting point for taint analysis, serving as the source of taint propagation; and performing vulnerability chain detection based on the method set S-1, the SQL injection vulnerability taint function set S-2, and the SSRF taint function set S-3 propagated step-by-step by the method parameters. This invention aims to improve the accuracy and coverage of existing static analysis tools in identifying SQL / SSRF vulnerabilities in the Java Spring framework, offering advantages such as high efficiency, accuracy, and high coverage.
Need to check novelty before this filing date? Find Prior Art