Detection of second order vulnerabilities in web services
AssigneeInternational Business Machines Corporation
InventorsYair Amit, Evgeny Beskrovny, Omer Tripp
Life of this patent
Estimating the term…
Abstract
A system for detecting a vulnerability in a Web service can include a processor configured to initiate executable operations including determining whether a Web service uses identity of a requester to select one of a plurality of different paths of a branch in program code of the Web service and, responsive to determining that the Web service does select one of a plurality of different paths of a branch according to identity of the requester, indicating that the Web service has a potential vulnerability.
Claims8
A system comprising:
- a processor configured to initiate executable operations comprising:
- determining whether a Web service uses identity of a requester to select one of a plurality of different paths of a branch in program code of the Web service;
- responsive to determining that the Web service does select one of a plurality of different paths of a branch according to identity of the requester, indicating that the Web service has a potential vulnerability;
- determining a trusted identity to which identity of the requester is compared;
- and
- submitting a payload to the Web service while impersonating the trusted identity.
A computer program product for detecting a vulnerability in a Web service, the computer program product comprising:
- a hardware storage device having computer readable program code embodied therewith, the computer readable program code comprising:
- computer readable program code configured to determine whether a Web service uses identity of a requester to select one of a plurality of different paths of a branch in program code of the Web service;
- and
- computer readable program code configured to, responsive to determining that the Web service does select one of a plurality of different paths of a branch according to identity of the requester, indicate that the Web service has a potential vulnerability;
- computer readable program code configured to determine a trusted identity to which identity of the requester is compared;
- and
- computer readable program code configured to submit a payload to the Web service while impersonating the trusted identity.
Dependencies are inferred from the claim text.