Static security scanner for applications in a remote network management platform

• US 10,719,611 B2
• Filed: 09/27/2017
• Issued: 07/21/2020
• Est. Priority Date: 09/27/2017
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: ServiceNow Incorporated
• Inventors: Mohan, Pavan
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Salman, Raied A
• Application Number:
  US15/716,696
• Publication Number:
  US 20190095626A1
• Time in Patent Office: 1,028 Days
• Field of Search: 726 25, 705 717, 713100
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

An example embodiment may involve a remote network management platform including a computational instance hosting a particular application. The particular application may be based on a unit of program code, use one or more database tables, and define one or more user roles with respect to accessing the program code and the database tables. A scanner application may be configured to: receive, from a client device, a request to scan the particular application; retrieve the particular application; conduct a static security scan by applying a set of rules that define security vulnerabilities, where the rules take into account (i) relationships between the user roles and the unit of program code, and (ii) relationships between the user roles and the database table; and transmit, to the client device, a representation of a web page that contains observed security vulnerabilities of the particular application.

Claims

1. A remote network management system comprising:

a computational instance associated with a managed network, the computational instance running in an environment having hardware resources configured to host a particular application, wherein the particular application is based on program code, uses one or more database tables, and defines at least two user roles with respect to accessing the program code and the one or more database tables, wherein a first user role of the at least two user roles and a second role of the at least two user roles have different sets of access permissions to the program code and the one or more database tables; and

one or more processors; and

a memory, wherein the memory includes instructions, that when executed by the one or more processors, cause the one or more processors to;

receive, from a graphical user interface displayed on a client device, a request to scan the particular application, wherein the request comprises an identifier of the computational instance, a password for access to the computational instance, and an identifier of the particular application;

in response to receiving the request to scan the particular application, retrieve the program code, the one or more database tables, and the one or more user roles from the computational instance based on the identifier of the computational instance, the password for access to the computational instance, and the identifier of the particular application;

conduct a static security scan of the program code, the one or more database tables, and the one or more user roles, wherein conducting the security scan comprises;

applying a set of rules that define security vulnerabilities that can be found in hosted applications on the remote network management system, wherein the set of rules take into account (i) relationships between the at least two user roles and the program code, (ii) relationships between the at least two user roles and the one or more database tables, and (iii) relationships between the at least two user roles; and

identifying, as a security vulnerability, a relationship between the first user role and a second user role, wherein the relationship comprises the first user role deriving access permissions from the second user role; and

transmit, to the client device, an update to the graphical user interface, wherein the update contains a categorized list of observed security vulnerabilities of the particular application that were found by the static security scan.

2. The remote network management system of claim 1, wherein the at least two user roles include one or more administrative user roles, one or more non-administrative user roles, and one or more null user roles, and wherein conducting the static security scan comprises:

identifying, as an additional security vulnerability, that at least one of the one or more database tables has an access control list that;

grants write or delete permission to the one or more non-administrative user roles, grants unlimited read access to the one or more non-administrative user roles, or grants any permission to the one or more null user roles.

3. The remote network management system of claim 1, wherein the at least two user roles include one or more administrative user roles and one or more non-administrative user roles, wherein the program code defines a function, and wherein conducting the static security scan comprises:

identifying, as an additional security vulnerability, that the one or more non-administrative user roles can call the function.

4. The remote network management system of claim 1, wherein conducting the static security scan comprises:

identifying, as an additional security vulnerability, that the program code contains a server-side include that allows execution of commands.

5. The remote network management system of claim 1, wherein conducting the static security scan comprises:

identifying, as an additional security vulnerability, that the program code contains a command that allows a user of the particular application to be redirected to a different web page.

6. The remote network management system of claim 1, wherein conducting the static security scan comprises:

identifying, as an additional security vulnerability, that the program code contains a publicly accessible web page.

7. The remote network management system of claim 1, wherein a scanner application defines one or more sensitive keywords, and wherein conducting the static security scan comprises:

identifying, as an additional security vulnerability, that the program code contains at least one of the sensitive keywords.

8. The remote network management system of claim 1, wherein the static security scan takes into account possible security vulnerabilities related to use, by the program code, of one or more application programming interfaces specific to the remote network management system.

9. The remote network management system of claim 1, wherein the static security scan takes into account possible security vulnerabilities related to use, by the program code, of one or more program coding conventions for developing custom applications for the remote network management system.

10. The remote network management system of claim 1, wherein an entry in the categorized list includes a hyperlink, wherein activating the hyperlink causes the scanner application to display details regarding observed security vulnerabilities related to the entry.

11. The remote network management system of claim 1, wherein an entry in the categorized list includes a hyperlink, wherein activating the hyperlink causes retrieval of a second web page from the computational instance, and wherein the second web page contains an observed security vulnerability corresponding to the entry.

12. The remote network management system of claim 1, wherein conducting the static security scan comprises conducting the static security scan without executing the program code.

13. The remote network management system of claim 1, wherein conducting the static security scan of the program code comprises conducting the static security scan of uncompiled program code.

14. A method comprising:

receiving, by a processor and from a graphical user interface displayed on a client device, a request to scan a particular application, wherein a remote network management platform includes a computational instance running in an environment having hardware resources configured to host the particular application, wherein the particular application is based on program code, uses one or more database tables, and defines at least two user roles with respect to accessing the program code and the one or more database tables, wherein a first user role of the at least two user roles and a second role of the at least two user roles have different sets of access permissions to the program code and the one or more database tables, and wherein the request comprises an identifier of the computational instance, a password for access to the computational instance, and an identifier of the particular application;

in response to receiving the request to scan the particular application, retrieving, by the processor, the program code, the one or more database tables, and the one or more user roles from the computational instance based on the identifier of the computational instance, the password for access to the computational instance, and the identifier of the particular application;

conducting, by the processor, a static security scan of the program code, the one or more database tables, and the one or more user roles, wherein conducting the security scan comprises;

applying a set of rules that define security vulnerabilities that can be found in hosted applications on the remote network management platform, wherein the set of rules take into account (i) relationships between the at least two user roles and the program code, (ii) relationships between the at least two user roles and the one or more database tables, and (iii) relationships between the at least two user roles; and

identifying, as a security vulnerability, a relationship between the first user role and a second user role, wherein the relationship comprises the first user role deriving access permissions from the second user role; and

transmitting, by the processor and to the client device, an update to the graphical user interface, wherein the update contains a categorized list of observed security vulnerabilities of the particular application that were found by the static security scan.

15. The method of claim 14, wherein the at least two user roles include one or more administrative user roles, one or more non-administrative user roles, and one or more null user roles, and wherein conducting the static security scan comprises:

identifying, as an additional security vulnerability, that at least one of the one or more database tables has an access control list that either;

grants write or delete permission to the one or more non-administrative user roles, grants unlimited read access to the one or more non-administrative user roles, or grants any permission to the one or more null user roles.

16. The method of claim 14, wherein the at least two user roles include one or more administrative user roles and one or more non-administrative user roles, wherein the program code defines a function, and wherein conducting the static security scan comprises:

identifying, as an additional security vulnerability, that the one or more non-administrative user roles can call the function.

17. The method of claim 14, wherein a scanner application defines one or more sensitive keywords, and wherein conducting the static security scan comprises:

identifying, as an additional security vulnerability, that the program code contains at least one of the sensitive keywords.

18. The method of claim 14, wherein the static security scan takes into account possible security vulnerabilities related to use, by the program code, of one or more program coding conventions for developing custom applications for the remote network management platform.

19. The method of claim 14, wherein an entry in the categorized list includes a hyperlink, wherein activating the hyperlink causes retrieval of a second web page from the computational instance, and wherein the second web page contains an observed security vulnerability corresponding to the entry.

20. An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions for a scanner application that, upon execution by a computing device, cause the computing device to perform operations comprising:

receiving, from a graphical user interface displayed on a client device, a request to scan a particular application, wherein a remote network management system includes a computational instance running in an environment having hardware resources configured to host the particular application, wherein the particular application is based on program code, uses one or more one or more database tables, and defines at least two user roles with respect to accessing the program code and the one or more database tables, wherein a first user role of the at least two user roles and a second role of the at least two user roles have different sets of access permissions to the program code and the one or more database tables, and wherein the request comprises an identifier of the computational instance, a password for access to the computational instance, and an identifier of the particular application;

in response to receiving the request to scan the particular application, retrieving the program code, the one or more database tables, and the one or more user roles from the computational instance based on the identifier of the computational instance, the password for access to the computational instance, and the identifier of the particular application;

conducting a static security scan of the program code, the one or more database tables, and the one or more user roles, wherein conducting the security scan comprises;

applying a set of rules that define security vulnerabilities that can be found in hosted applications on the remote network management system, wherein the set of rules take into account (i) relationships between the at least two user roles and the program code, (ii) relationships between the at least two user roles and the one or more database tables, and (iii) relationships between the at least two user roles; and

identifying, as a security vulnerability, a relationship between the first user role and a second user role, wherein the relationship comprises the first user role deriving access permissions from the second user role; and

transmitting, to the client device, an update to the graphical user interface, wherein the update contains a categorized list of observed security vulnerabilities of the particular application that were found by the static security scan.