Detection of second order vulnerabilities in web services
View Patent ↗A method detecting a vulnerability in a Web service can include determining, using a processor, whether a Web service uses identity of a requester to select one of a plurality of different paths of a branch in program code of the Web service. The method further can include, responsive to determining that the Web service does select one of a plurality of different paths of a branch according to identity of the requester, indicating that the Web service has a potential vulnerability.
1. A computer-implemented method performed by a security system configured to test a Web service, comprising:
performing, by the security system, a static analysis on the Web service;
locating, during the static analysis, a seed instruction in program code of the Web service in which identity of a requester is determined by the Web service;
determining, during the static analysis, whether a value from the seed instruction is determinative in selecting between a plurality of paths for a branch in the program code; and
indicating, by the security system and responsive to the determining, that the Web service has a potential vulnerability based upon the Web service selecting one of the plurality of paths according to the identity of the requester.
2. The method of claim 1 , wherein
a trusted identity to which identity is compared is determined, and
a payload is submitted to the Web service in which the trusted identify is impersonated.
3. The method of claim 2 , wherein
the program code of the Web service is instrumented with first diagnostic program code configured to determine the trusted identity responsive to execution of the Web service.
4. The method of claim 2 , wherein
a response to the payload from the Web service is compared with an expected response; and
the indicating is based upon the comparing.
5. The method of claim 1 , wherein
the program code of the Web service is instrumented using second diagnostic program code configured to defeat identity decryption within the Web service responsive to execution of the Web service.
6. A computer hardware system including a security system configured to test a Web service, comprising:
a hardware processor configured to initiate the following executable operations:
performing, by the security system, a static analysis on the Web service;
locating, during the static analysis, a seed instruction in program code of the Web service in which identity of a requester is determined by the Web service;
determining, during the static analysis, whether a value from the seed instruction is determinative in selecting between a plurality of paths for a branch in the program code; and
indicating, by the security system and responsive to the determining, that the Web service has a potential vulnerability based upon the Web service selecting one of the plurality of paths according to the identity of the requester.
7. The system of claim 6 , wherein
a trusted identity to which identity is compared is determined, and
a payload is submitted to the Web service in which the trusted identify is impersonated.
8. The system of claim 7 , wherein
the program code of the Web service is instrumented with first diagnostic program code configured to determine the trusted identity responsive to execution of the Web service.
9. The system of claim 7 , wherein
a response to the payload from the Web service is compared with an expected response; and
the indicating is based upon the comparing.
10. The system of claim 6 , wherein
the program code of the Web service is instrumented using second diagnostic program code configured to defeat identity decryption within the Web service responsive to execution of the Web service.
11. A computer program product, comprising:
a hardware storage device having stored therein computer executable program code,
the computer executable program code, which when executed by a computer hardware system including a security system configured to test a Web service, causes the computer hardware system to perform:
performing, by the security system, a static analysis on the Web service;
locating, during the static analysis, a seed instruction in program code of the Web service in which identity of a requester is determined by the Web service;
determining, during the static analysis, whether a value from the seed instruction is determinative in selecting between a plurality of paths for a branch in the program code; and
indicating, by the security system and responsive to the determining, that the Web service has a potential vulnerability based upon the Web service selecting one of the plurality of paths according to the identity of the requester.
12. The computer program product of claim 11 , wherein
a trusted identity to which identity is compared is determined, and
a payload is submitted to the Web service in which the trusted identify is impersonated.
13. The computer program product of claim 12 , wherein
the program code of the Web service is instrumented with first diagnostic program code configured to determine the trusted identity responsive to execution of the Web service.
14. The computer program product of claim 12 , wherein
a response to the payload from the Web service is compared with an expected response; and
the indicating is based upon the comparing.
15. The computer program product of claim 11 , wherein
the program code of the Web service is instrumented using second diagnostic program code configured to defeat identity decryption within the Web service responsive to execution of the Web service.