Hierarchical runtime analysis framework for defining vulnerabilities
First Claim
1. A computer program product comprising a non-transitory computer-readable medium containing an executable set of instructions for detecting potential vulnerabilities in a software application in a database system, the set of instructions operable to:
- receive a hierarchical list of input tags defining a hierarchy of requests received by the software application, wherein at least some of the input tags have hierarchical relationships, wherein the hierarchical list of input tags includes a parent hypertext transfer protocol (HTTP) input tag and child sibling page, header, and universal resource locator (URL) input tags;
receive a hierarchical list of output tags defining a hierarchy of outputs generated by the software application, wherein at least some of the output tags have hierarchical relationships, wherein the hierarchical list of output tags includes a parent hypertext transfer protocol (HTTP) output tag and child sibling page, header, and universal resource locator (URL) output tags;
receive defined vulnerabilities wherein the defined vulnerabilities include at least one associated input tag and at least one associated output tag;
receive a request in the database system from a user system;
assign an input tag from the hierarchical list of input tags to an object associated with the request, the input tag identifying the request as carrying a security risk and identifying a type of data within object and a particular type of user input, including a URL input;
assign an output tag from the hierarchical list of output tags to an output method generating a response to the request; and
identify one of the defined vulnerabilities as a candidate vulnerability when the assigned output tag and output tag associated the defined vulnerability are within a same subtree in the hierarchical list of output tags; and
identify the candidate vulnerability as a potential vulnerability when the assigned input tag and the input tag associated with the candidate vulnerability are within a same subtree in the hierarchical list of input tags.
1 Assignment
0 Petitions
Accused Products
Abstract
A runtime analysis framework (RTA) stores a hierarchical list of input tags and a hierarchical list of output tags. The RTA stores defined vulnerabilities that include associated input tags and output tags. During runtime the software application may receive a request from a user system. The RTA assigns an input tag from the hierarchical list of input tags to an object associated with the request and assigns an output tag from the hierarchical list of output tags to a method generating a response to the request. The RTA identifies one of the defined vulnerabilities as a potential vulnerability if the assigned output tag and output tag associated the potential vulnerability are in a same subtree of the hierarchical list of output tags and the assigned input tag and the input tag associated with the potential vulnerability are in a same subtree of the hierarchical list of input tags.
-
Citations
16 Claims
-
1. A computer program product comprising a non-transitory computer-readable medium containing an executable set of instructions for detecting potential vulnerabilities in a software application in a database system, the set of instructions operable to:
-
receive a hierarchical list of input tags defining a hierarchy of requests received by the software application, wherein at least some of the input tags have hierarchical relationships, wherein the hierarchical list of input tags includes a parent hypertext transfer protocol (HTTP) input tag and child sibling page, header, and universal resource locator (URL) input tags; receive a hierarchical list of output tags defining a hierarchy of outputs generated by the software application, wherein at least some of the output tags have hierarchical relationships, wherein the hierarchical list of output tags includes a parent hypertext transfer protocol (HTTP) output tag and child sibling page, header, and universal resource locator (URL) output tags; receive defined vulnerabilities wherein the defined vulnerabilities include at least one associated input tag and at least one associated output tag; receive a request in the database system from a user system; assign an input tag from the hierarchical list of input tags to an object associated with the request, the input tag identifying the request as carrying a security risk and identifying a type of data within object and a particular type of user input, including a URL input; assign an output tag from the hierarchical list of output tags to an output method generating a response to the request; and identify one of the defined vulnerabilities as a candidate vulnerability when the assigned output tag and output tag associated the defined vulnerability are within a same subtree in the hierarchical list of output tags; and identify the candidate vulnerability as a potential vulnerability when the assigned input tag and the input tag associated with the candidate vulnerability are within a same subtree in the hierarchical list of input tags. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A system for detecting vulnerabilities in a software application operating in a database system, comprising:
-
a processor; and memory storing one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of; receiving a hierarchical list of input tags defining a hierarchy of requests received, wherein the hierarchical list of input tags includes a parent hypertext transfer protocol (HTTP) input tag and child sibling page, header, and universal resource locator (URL) input tags; receiving a hierarchical list of output tags defining a hierarchy of outputs, wherein the hierarchical list of output tags includes a parent hypertext transfer protocol (HTTP) output tag and child sibling page, header, and universal resource locator (URL) output tags; receiving defined vulnerabilities each including an associated input tag and an associated output tag; receiving a request by the software application in the database system from a user system; assigning an input tag from the hierarchical list of input tags to an object returned by the software application based on the request, the input tag identifying the request as potentially malicious and carrying a security risk and identifying a type of data within object and a particular type of user input, including a URL input; assigning an output tag from the hierarchical list of output tags to an output method in the software application generating a response to the request; identifying one of the defined vulnerabilities as a candidate vulnerability when the assigned output tag and output tag associated the defined vulnerability are within a same subtree in the hierarchical list of output tags; and identifying the candidate vulnerability as a potential vulnerability when the assigned input tag and the input tag associated with the candidate vulnerability are within a same subtree in the hierarchical list of input tags. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
-
15. A method for detecting a vulnerability in a software application in a database system, comprising:
-
storing a hierarchical input tree that identifies hierarchical relationships for different input events; storing a hierarchical output tree that identifies hierarchical relationships for different output events; receive a defined vulnerability that includes an output event, an input event, and a sanitization event; receiving by the software application in the database system a request from a user system; executing an input rule in the software application that identifies an input event for an object associated with the request; executing a sanitization rule in the software application that identifies a sanitization event for a security operation performed on the object; executing an output rule in the software application that identifies an output event for a method generating a response to the request; and executing a vulnerability rule in the software application that identifies a vulnerability in a part of the software application based on a hierarchical relationship between the identified output event and the defined vulnerability output event, a hierarchical relationship between the identified input event and the defined vulnerability input event, and a relationship between the identified sanitization event and the defined vulnerability sanitization event. - View Dependent Claims (16)
-
Specification