Runtime analysis of software security vulnerabilities

• US 10,387,658 B2
• Filed: 10/11/2018
• Issued: 08/20/2019
• Est. Priority Date: 06/08/2016
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Gorbaty, Sergey, Safford, Travis, Wang, Xiaoran, Gluck, Yoel
• Primary Examiner(s): Hoffman, Brandon S
• Assistant Examiner(s): Corum, Jr., William A
• Application Number:
  US16/158,098
• Publication Number:
  US 20190042762A1
• Time in Patent Office: 313 Days
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

During runtime of the software application, the runtime analysis framework may assign input tags to objects associated with the user requests. The input tags may identify the requests as potentially malicious and carry a security risk. The RTA framework then may assign sanitization tags to the objects identifying security checks performed on the objects during runtime. The RTA framework identifies output responses to the user requests that include the objects and compares the input tags assigned to the objects with any sanitization tags assigned to the objects. The RTA framework may identify the software application as susceptible to a security vulnerability when the input tags for the objects do not include corresponding sanitization tags.

Claims

1. A computer program product comprising a program stored on a non-transitory computer-readable medium containing an executable set of instructions for detecting a vulnerability in a software application in a database system, the set of instructions operable to:

store defined vulnerabilities that identify operations in the software application vulnerable to the security risk and are each associated with one or more input tags and one or more sanitization tags;

receive by the software application in the database system a request from a user system;

at runtime of the application, assign one or more of the input tags to one or more objects associated with the request, wherein the input tags identify the request as potentially malicious and carrying a security risk;

at runtime of the application, assign one or more of the sanitization tags to the one or more objects associated with the request to indicate security checks performed on the objects;

at runtime of the application, identify output responses to the request that include the one or more objects, and compare the input tags assigned to the one or more objects with any of the sanitization tags assigned to the objects;

responsive to the input tags for the one or more objects not having corresponding assigned ones of the sanitization tags, reporting the software application as vulnerable to the security risk.

2. The computer program product of claim 1, further comprising instructions operable to assign an output tag to an output method generating a response to the request, wherein the output tag triggers the comparison of the input tags with any of the sanitization tags.

3. The computer program product of claim 2, wherein the output method writes data associated with the objects to a web page, database, or file.

4. The computer program product of claim 2, wherein the output method generates a hypertext transfer protocol (HTTP) response to the request.

5. The computer program product of claim 1, further comprising instructions operable to generate a report identifying a method and a location in the software application identified as vulnerable to the security risk.

6. The computer program product of claim 1, further comprising instructions operable to assign the input tags to the objects based on types of input methods receiving the request.

7. The computer program product of claim 1, further comprising instructions operable to generate rules in bytecode of the software application, wherein the rules assign the input tags and assign the sanitization tags.

8. A system for detecting vulnerabilities in a software application operating in a database system, comprising:

a processor; and

memory storing one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of;

storing defined vulnerabilities that identify operations in the software application vulnerable to the security risk and are each associated with one or more input tags and one or more sanitization tags;

assigning the one or more of the input tags to objects returned by input methods in the software application, wherein the input tags identify the objects as potentially malicious and security risks;

assigning the one or more of the sanitization tags to the one or more objects associated with the request, wherein the sanitization tags identify security checks performed on the objects;

identifying output responses to the request that include the one or more objects, and comparing the input tags assigned to the one or more objects with any of the sanitization tags assigned to the objects; and

responsive to the input tags for the one or more objects not having corresponding assigned ones of the sanitization tags, generating a report reporting the software application as vulnerable to the security risk.

9. The system of claim 8, wherein the instructions further cause the processor to carry out the steps of assigning the input tags, assigning the sanitization tags, comparing the input tags with the sanitization tags, and identifying the vulnerability in a part of the software application during runtime of the software application.

10. The system of claim 8, wherein the instructions further cause the processor to carry out the steps of assigning an output tag to an output method in the software application, wherein the output tag identifies the output method as a part of the software application potentially vulnerable to the security risk.

11. The system of claim 10, wherein the instructions further cause the processor to carry out the steps of:

storing the defined vulnerabilities an associated one or more output tags; and

identifying the vulnerability in the software application when the output tag associated with the defined vulnerability matches the assigned output tag for one of the objects, the input tag associated with the defined vulnerability matches the assigned input tag for a same one of the objects, and one or more of the sanitization tags associated with the defined vulnerability is not an assigned sanitization tag for the same one of the objects.

12. The system of claim 11, wherein the output method writes data associated with the objects to a web page, database, or file.

13. The system of claim 12, wherein the instructions further cause the processor to carry out the steps of adding bytecode to the software application, wherein the bytecode assigns the input tags, assigns the sanitization tags, compares the input tags with the sanitization tags, and identifies the vulnerability in a part of the software application.