Detection of second order vulnerabilities in web services
AssigneeInternational Business Machines Corporation
InventorsYAIR AMIT, EVGENY BESKROVNY, OMER TRIPP
Life of this patent
Estimating the term…
Abstract
A method detecting a vulnerability in a Web service can include determining, using a processor, whether a Web service uses identity of a requester to select one of a plurality of different paths of a branch in program code of the Web service. The method further can include, responsive to determining that the Web service does select one of a plurality of different paths of a branch according to identity of the requester, indicating that the Web service has a potential vulnerability.
Claims16
1-25. (canceled)
A computer-implemented method performed by a security system configured to test a Web service, comprising:
- performing, by the security system, a static analysis on the Web service;
- locating, during the static analysis, a seed instruction in program code of the Web service in which identity of a requester is determined by the Web service;
- determining, during the static analysis, whether a value from the seed instruction is determinative in selecting between a plurality of paths for a branch in the program code;
- and
- indicating, by the security system and responsive to the determining, that the Web service has a potential vulnerability based upon the Web service selecting one of the plurality of paths according to the identity of the requester.
A computer hardware system including a security system configured to test a Web service, comprising:
- a hardware processor configured to initiate the following executable operations:
- performing, by the security system, a static analysis on the Web service;
- locating, during the static analysis, a seed instruction in program code of the Web service in which identity of a requester is determined by the Web service;
- determining, during the static analysis, whether a value from the seed instruction is determinative in selecting between a plurality of paths for a branch in the program code;
- and
- indicating, by the security system and responsive to the determining, that the Web service has a potential vulnerability based upon the Web service selecting one of the plurality of paths according to the identity of the requester.
A computer program product, comprising:
- a hardware storage device having stored therein computer executable program code,
- the computer executable program code, which when executed by a computer hardware system including a security system configured to test a Web service, causes the computer hardware system to perform:
- performing, by the security system, a static analysis on the Web service;
- locating, during the static analysis, a seed instruction in program code of the Web service in which identity of a requester is determined by the Web service;
- determining, during the static analysis, whether a value from the seed instruction is determinative in selecting between a plurality of paths for a branch in the program code;
- and
- indicating, by the security system and responsive to the determining, that the Web service has a potential vulnerability based upon the Web service selecting one of the plurality of paths according to the identity of the requester.
Dependencies are inferred from the claim text.