Detection of second order vulnerabilities in web services

Patent metadata

Field	Value
Publication number	US-10579802-B2
Application number	US-201213430002-A
Country	US
Kind code	B2
Filing date	Mar 26, 2012
Priority date	Dec 22, 2011
Publication date	Mar 3, 2020
Grant date	Mar 3, 2020

Abstract

A method of detecting a vulnerability in a Web service can include determining, using a processor, whether a Web service uses identity of a requester to select one of a plurality of different paths of a branch in program code of the Web service. The method further can include, responsive to determining that the Web service does select one of a plurality of different paths of a branch according to identity of the requester, indicating that the Web service has a potential vulnerability.

First claim

The invention claimed is:

1. A method detecting a vulnerability in a Web service, the method comprising:
determining, using a processor, whether a Web service uses identity of a requester to select one of a plurality of different paths of a branch in program code of the Web service;
responsive to determining that the Web service does select one of a plurality of different paths of a branch according to identity of the requester, indicating that the Web service has a potential vulnerability;
determining a trusted identity to which identity of the requester is compared; and
submitting a payload to the Web service while impersonating the trusted identity.

2. The method of claim 1 , further comprising:
instrumenting the program code of the Web service with first diagnostic program code configured to determine the trusted identity responsive to execution of the Web service.

3. The method of claim 1 , further comprising:
defeating identity verification within the Web service.

4. The method of claim 3 , further comprising:
instrumenting the program code of the Web service using second diagnostic program code configured to defeat identity verification responsive to execution of the Web service.

5. The method of claim 1 , further comprising:
defeating identity decryption within the Web service.

6. The method of claim 5 , further comprising:
instrumenting the program code of the Web service using second diagnostic program code configured to defeat identity decryption within the Web service responsive to execution of the Web service.

7. The method of claim 1 further comprising:
comparing a response to the payload from the Web service with an expected response; and
indicating whether the Web service has a vulnerability according to the comparing.

8. The method of claim 1 , further comprising:
locating a seed instruction in the program code of the Web service in which identity of the requester is determined; and
determining whether a value of the seed instruction that indicates identity of the requestor is determinative in selecting one of the plurality of paths for the branch.

9. A method of detecting a vulnerability in a Web service, the method comprising:
locating a seed instruction in program code of a Web service in which identity of a requester is determined;
determining, using a processor, whether a value from the seed instruction indicating identity of the requester is determinative in selecting between a plurality of paths for a branch in program code of the Web service;
indicating that the Web service includes a potential vulnerability responsive to determining that the value from the seed instruction is determinative in selecting between the plurality of paths for the branch; and
instrumenting the program code of the Web service with first diagnostic program code configured to determine a trusted identity to which identity of the requester is compared responsive to execution of the Web service with the first diagnostic program code to determine the trusted identity.

10. The method of claim 9 , further comprising:
submitting a payload to the Web service while impersonating the trusted identity.

11. The method of claim 10 , further comprising:
comparing a response from the Web service to the payload with an expected response.

12. The method of claim 9 , further comprising:
instrumenting the program code of the Web service with second diagnostic program code configured to defeat identity verification within the Web service responsive to execution of the Web service.

13. The method of claim 9 , further comprising:
instrumenting the program code of the Web service with second diagnostic program code configured to defeat identity decryption within the Web service responsive to execution of the Web service.

Assignees

• Amit Yair
• Beskrovny Evgeny
• Tripp Omer
• IBM

Inventors

• Amit Yair
• Beskrovny Evgeny
• Tripp Omer

Classifications

• G05B2219/31085

  Application scripts; in web server, not sent to client · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G07B2017/00911

  Trusted party · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• G05B2219/32136

  Web service oriented architecture for manufacturing and automation · CPC title