Detecting stored cross-site scripting vulnerabilities in web applications

• US 9,876,816 B2
• Filed: 10/03/2016
• Issued: 01/23/2018
• Est. Priority Date: 08/25/2011
• Status: Active Grant

• Current Assignee: Finjan Blue, Inc. (FIG LLC (d/b/a Fortress Investment Group LLC))
• Original Assignee: International Business Machines Corporation
• Inventors: Amit, Yair, Landa, Alexander, Tripp, Omer
• Primary Examiner(s): POWERS, WILLIAM S
• Application Number:
  US15/283,664
• Publication Number:
  US 20170024567A1
• Time in Patent Office: 477 Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system for detecting security vulnerabilities in web applications, the system including, a black-box tester configured to provide a payload to a web application during a first interaction with the web application at a computer server, where the payload includes a payload instruction and an identifier, and an execution engine configured to detect the identifier within the payload received during an interaction with the web application subsequent to the first interaction, and determine, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction.

Claims

1. A method for detecting security vulnerability in a web application, comprising:

providing, to the web application and during a first interaction with the web application on a computer server, a payload including payload instruction and an identifier distinct from the payload instruction;

detecting, within the payload received during an interaction with the web application subsequent to the first interaction, the identifier; and

determining, responsive to detecting the identifier within the payload, whether the payload instruction underwent a security check prior to execution of the payload instruction.

2. The method of claim 1, further comprising:

reporting, upon the determining that the payload instruction did not undergo a security check prior to the execution of the payload instruction, that the web application is vulnerable to a stored cross-site scripting attacking.

3. The method of claim 2, wherein

the reporting indicates an interface of the web application through which the payload was introduced.

4. The method of claim 2, wherein

the reporting indicates a location within the payload at which the payload instruction is found.

5. The method of claim 1, further comprising:

receiving, subsequent to the first interaction, an interaction-initiating instruction from the web application during a second interaction with the web application;

receiving, during a third interaction with the web application subsequent to the second interaction, the payload; and

initiating the third interaction with the web application by executing the interaction-initiating instruction.

6. The method of claim 5, wherein

the interaction-initiating instruction is an AJAX request.

7. The method of claim 1, wherein

the determining includes determining whether the payload instruction underwent the security check by being processed by either of a sanitizer and a validator.

8. The method of claim 1, wherein

the payload instruction is a predefined security-sensitive instruction.

9. The method of claim 8, wherein

the security-sensitive instruction is a DOM API command.

10. The method of claim 1, wherein

the payload instruction is computer-executable instructions and

the identifier is a unique alphanumeric identifier.