Persistent cross-site scripting vulnerability detection

• US 9,948,665 B2
• Filed: 06/04/2015
• Issued: 04/17/2018
• Est. Priority Date: 11/25/2014
• Status: Active Grant

• Current Assignee: HCL Technologies Limited
• Original Assignee: International Business Machines Corporation
• Inventors: Bronshtein, Emanuel, Hay, Roee, Kedmi, Sagi
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US14/730,261
• Publication Number:
  US 20160149947A1
• Time in Patent Office: 1,048 Days
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

Various techniques for detecting a persistent cross-site scripting vulnerability are described herein. In one example, a method includes detecting, via the processor, a read operation executed on a resource using an instrumentation mechanism and returning, via the processor, a malicious script in response to the read operation. The method also includes detecting, via the processor, a write operation executed on the resource using the instrumentation mechanism and detecting, via the processor, a script operation executed by the malicious script that results in resource data being sent to an external computing device from a client device. Furthermore, the method includes receiving, via the processor, metadata indicating the execution of the read operation, the write operation, and the script operation.

Claims

1. A method for detecting a persistent cross-site scripting vulnerability comprising:

inserting, via a processor, a client-side script as input into a web application;

requesting, via the processor, data from the web application;

in response to requesting the data, detecting that resource is sent from a client device to an external computing device in response to execution of the client-side script on the client device, wherein the external computing device is a different device than the client device;

receiving at the external computing device, the inserted client-side script in response to requesting data from the web application;

receiving from the external computing device, the inserted client-side script, in response to receiving the client-side script at the external computing device;

detecting, via the processor, that the client-side script is subsequently returned unaltered via the data request by comparing the inserted client-side script with the received client side script, and that execution of the client-side script occurs.

2. The method of claim 1, further comprising:

monitoring function calls to one or more resources to detect a write operation attempting to store the inputted client-side script on a resource without alteration.

3. The method of claim 1, wherein the inserted input simulates user interaction with the web application.

4. The method of claim 1, further comprising, responsive to detecting that execution of the client-side script occurred, creating an indicator of a cross-site scripting vulnerability found in the web application.

5. The method of claim 1, wherein the inserted client-side script contains instructions to send an alert when executed.

6. The method of claim 5, wherein detecting whether execution of the client-side script occurs comprises receiving the alert.