Detecting Stored XSS Vulnerabilities via Interface Data Store Tracing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing black-box testing tools have limited success in determining whether web applications are vulnerable to stored cross-site scripting (XSS) attacks, as they fail to effectively identify security vulnerabilities associated with interactions between different interfaces and a persistent data store.

Innovation Solution

A method and system that interact with a computer software application's interfaces to detect and record associations between write and read operations within a persistent data store, using test data with malicious payload characteristics to identify stored security vulnerabilities by writing and reading data from specific locations in the data store.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Extent of automation

If black-box testing tools are used to detect security vulnerabilities, then automated security testing is performed, but the ability to identify stored XSS vulnerabilities is limited

Engineering Contradiction:

Improveautomated security testingVSAvoidvulnerability detection accuracy

Core Design Contradiction:

Extent of automationVSMeasurement precision

Solution Approach 1:

The patent introduces an intermediary testing mechanism that traces data flow between interfaces and persistent data stores. This intermediary layer captures and analyzes data interactions, enabling automated detection of stored XSS vulnerabilities by monitoring how data is written to and read from persistent storage, thereby resolving the limitation of traditional black-box tools in detecting stored attacks

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent performs preliminary actions by pre-identifying and recording associations between interfaces and persistent data store locations before conducting vulnerability tests. This preliminary mapping of data flow paths enables the testing tool to efficiently inject and trace malicious payloads through the system, improving both automation capability and detection precision for stored XSS vulnerabilities

Inventive Principle:

Principle #10Preliminary action

2Ease of operation

If traditional black-box testing methods are used, then interface interactions are tested, but associations with persistent data store operations are not identified

Engineering Contradiction:

Improveinterface testingVSAvoiddata flow association information

Core Design Contradiction:

Ease of operationVSLoss of information

Solution Approach 1:

The patent implements feedback mechanisms that capture data flow information from interface interactions and feed it back into the testing system. By monitoring and recording associations between interface operations and persistent data store accesses, the system maintains comprehensive information about data paths, preventing loss of critical vulnerability detection information while keeping the testing process operational

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS10019581B2Identifying stored security vulnerabilities in computer software applications

Publication Date: 2018.07.10 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Identifying stored security vulnerabilities in computer software applications by providing via a first interface of a computer software application during execution of the computer software application, test data having a characteristic of a malicious payload, where an interaction performed with the first interface resulted in data being written to a location within a persistent data store, and where an interaction performed with a second interface of the computer software application resulted in data being read from the location within the persistent data store, and identifying a stored security vulnerability associated with the computer software application if the test data are written to the persistent data store at the location.