1. Field of the Invention
The present invention relates generally to web services, and more particularly to program code for identifying stored vulnerabilities in a web service.
2. Description of the Related Art
Web services are an important building block in web architectures. Specifically, web services provide remote services to remote clients, thereby enabling online retrieval and processing of data in web applications and other web services. The rapid increase in the popularity of web services also makes them the target of a growing number of security attacks, which has led to the development of specialized testing tools for security vulnerabilities in web services.
For example, it is known for black-box security tools, such as IBM Security AppScan Standard and Enterprise Edition, to have scanning capabilities specific to web services. However, the black-box security tools are currently limited to identifying reflected injection attacks (i.e., reflected security vulnerabilities), where the tool submits an input containing a test payload, and validates whether the test succeeded based on the response from the web service.
In addition to reflected security vulnerabilities, there are persistent stored vulnerabilities, wherein the test payload does not directly flow into the response corresponding to an enclosing web service request, instead arrives at some persistent storage (e.g., a file or a database). The payload is later read due to another web service request, which triggers the inclusion of the payload in the response corresponding to the enclosing web service request.
Identifying stored vulnerabilities via black-box security tools can be challenging, because the security tools scanning a software application for stored vulnerabilities may not be aware of the internal components of the software application. The lack of awareness of the internal components of the software application makes it difficult for the security tools to identify web service request sequences capable of exposing stored vulnerabilities. Furthermore, the lack of awareness of the internal components of the software application makes it difficult to identify input parameters that trigger such sequences. As a result, current black-box scanners may not identify certain stored vulnerabilities in web services.
Aspects of an embodiment of the present invention disclose a method, computer system, and program product for identifying stored vulnerabilities in a web service. A computer identifies each web method, of a web service, declared in a web services description language (WSDL) file. The computer adds a node within a directed graph for each web method identified. The computer identifies pairs of web methods declared in the WSDL file in which a match exists between an output parameter of one of the web methods within one of the pairs identified, and an input parameter of another one of the web methods within the one of the pairs identified. The computer adds an edge within the directed graph for each of the pairs of web methods identified. The computer generates one or more sequences of web methods based on nodes connected by edges within the directed graph, wherein each of the one or more sequences of web methods includes at least one of the pairs of web methods identified. The computer tests each of the one or more sequences of web methods to identify stored vulnerabilities in the web service.
The subject matter which is regarded as an embodiment of the present invention is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. One manner in which recited features of an embodiment of the present invention can be understood is by reference to the following detailed description of embodiments, taken in conjunction with the accompanying drawings in which:
As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method or computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.
Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as JAVA, Smalltalk, C++ or the like, conventional procedural programming languages such as the “C” programming language, a hardware description language such as VERILOG, or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
Aspects of the present invention are described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.
The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
Exemplary embodiments now will be described more fully herein with reference to the accompanying drawings. This disclosure may, however, be embodied in many different forms and should not be construed as limited to the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of this disclosure to those skilled in the art. In the description, details of well-known features and techniques may be omitted to avoid unnecessarily obscuring the presented embodiments.
Embodiments of the present invention provide a web service vulnerabilities detection program having program code for identifying stored vulnerabilities (i.e., stored attacks) in a web service. Stored vulnerabilities in a web service refer to a malicious value (e.g., malicious code) embedded within information data stored on a server computer. Specifically, the malicious value resides in persistent storage (e.g., in a file or in a database) on the server computer. The malicious value can be accessed by client software on a client computer (e.g., laptop, smartphone, or tablet), wherein the client software accesses the malicious value via a web service request for the information data stored on the server computer. For example, a web service that exposes banking operations may allow an end-user to register as a new account holder by entering information data (e.g., the end-user's credentials) into data fields of an electronic form, wherein subsequent to the end-user's registration the information data is stored in a database. If a malicious value (e.g., a malicious script) is entered into one of the data fields of the electronic form, and a subsequent web service request (e.g., money transfer) reads the malicious value and performs an unsafe operation based on the malicious value, then a stored vulnerability exists. The vulnerability is referred to as stored, because the malicious value is stored in persistent storage (e.g., a file or a database) prior to being included in any response to a web service request. Stored vulnerabilities can compromise the security of the information data stored on a server computer, and can even cause damage to other computers that interact with the server computer such as a client computer that sends a web service request to the server computer.
Client computer 105a is installed with client software 130 and web service vulnerabilities detection program 140. Client computer 105a can be any mobile computer device such as a laptop, smartphone, or tablet. Client software 130 can be any type of computer software application (e.g., browser, mobile application, or desktop application) that interacts with server computer 105b to access web service 155 via a formatted message, wherein web service 155 includes one or more web methods (i.e., program functions) of server software program 150 installed on server computer 105b. For example, web service 155 can include the following: a bank service; a map service; and even a government service. In addition, server computer 105b includes web service directory 160 and at least one WSDL file 165. Web service directory 160 lists all web services including web service 155 provided by server software program 150, and lists any other programs that may be installed on server computer 105b. WSDL file 165 describes web service 155. Specifically, WSDL file 165 describes parameters and parameter data types associated to each web method of web service 155. Furthermore, vulnerabilities detection program 140 is program code, wherein the program code includes functionality for generating a web service request sequence (i.e., generating a sequence of web methods) to identify stored vulnerabilities in web service 155.
Subsequently, vulnerabilities detection program 140 identifies pairs of web methods Mx and My declared in WSDL file 165, wherein a match exists between an output parameter of one of the web methods Mx within a pair, and an input parameter of another one of the web methods My within the pair (block 215). The subscripts x and y can be any value utilized as a unique identifier of each web method declared in WSDL file 165. Thus, each web method declared in WSDL file 165 is assigned a unique identifier.
Specifically, in the disclosed embodiment, a match exists if the complex data type (i.e., data structure) of the output parameter of one of the web methods Mx in a pair is identical to the complex data type of an input parameter of another one of the web methods My in the pair. However, if the data type of the output parameter of web method Mx in the pair is a primitive data type (e.g., boolean, byte, char, int, long, short, double, float, string), then a match exists if a name of the output parameter of web method Mx in the pair is identical to a name of an input parameter of web method My in the pair.
Next, vulnerabilities detection program 140 adds an edge (NMx, NMy) within the directed graph for each of the pairs of web methods identified, thereby creating a set of edges that includes one or more sequences of web methods (block 220). An edge is a connection (i.e., an association) between two different nodes within the directed graph. Each of the edges indicate a match exists between respective web methods Mx and My. Thus, each edge (NMx, NMy) indicates a match exists between a first web method (e.g., a web method represented by a node NMx) and a second web method (e.g., a web method represented by a node NMy), wherein the first and second web method can be referred to as a sequence of web methods. However, a match may exist between the second web method and a third web method, and another match may exist between the third web method and a fourth web method, and so on and so forth. Thus, a sequence of web methods can include more than two web methods if there are interim web methods sharing parameters between each other.
Next, vulnerabilities detection program 140 marks each node, within the directed graph, having at least one input parameter with a complex data type (block 225). Each node marked can be utilized as a starting point for testing a sequence of web methods within web service 155 in order to identify a stored vulnerability within web service 155. Thus, each marked node represents the first web method within a sequence of web methods to be tested.
Next, vulnerabilities detection program 140 generates each sequence of web methods (i.e., each path) based on the set of nodes and the set of edges within the directed graph (block 230). Specifically, to generate each sequence of web methods vulnerabilities detection program 140 searches the directed graph by utilizing a breadth-first search to identify each node representing a web method having an output parameter that matches with at least one input parameter of another web method represented by a node within the directed graph. For example, vulnerabilities detection program 140 can utilize a breadth-first search to traverse each edge within the directed graph, and access the nodes connected by an edge in order to identify a match between an output parameter of a first web method and an input parameter of a second web method, a match between an output parameter of the second web method and an input parameter of a third web method, a match between an output parameter of the third web method and an input parameter of a fourth web method, and so on and so forth. If the amount of sequences of web methods does not exceed a threshold (the “NO” branch of decision block 235), then vulnerabilities detection program 140 tests each of the sequences of web methods (block 245). Otherwise, if the amount of sequences of web methods exceeds the threshold (the “YES” branch of decision block 235), then vulnerabilities detection program 140 applies a heuristic to the directed graph to reduce the amount of sequences of web methods to be subsequently tested (block 240). Thus, if WSDL file 165 contains a large amount of web methods, applying the heuristic can control the number of sequences of web methods subsequently tested. Next, vulnerabilities detection program 140 tests each of the sequences of web methods (block 245), and vulnerabilities detection program 140 ends.
Vulnerabilities detection program 140 can utilize nodes 402-404, as well as edges 450-452 within directed graph 400 to generate sequences of web methods for testing stored vulnerabilities in web service 155. For example, in the disclosed embodiment, the sequences of web methods generated by vulnerabilities detection program 140 include two sequences, wherein the first sequence of web methods is RegisterCustomer 402 and GetCustomerDetails 403, and wherein the second sequence of web methods is GetCustomerOrders 404, GetCustomerDetails 403, and RegisterCustomer 402.
Each set of internal components 800a and 800b includes a R/W drive or interface 832 to read from and write to one or more portable computer readable tangible storage devices 936 such as CD-ROM, DVD, memory stick, magnetic tape, magnetic disk, optical disk or semiconductor storage device. Client software 130 and vulnerabilities detection program 140 on client computer 105a; and server software program 150 having web services 155 on server computer 105b can be stored on one or more of the respective portable computer readable tangible storage devices 936, read via the respective R/W drive or interface 832 and loaded into the respective hard drive or computer readable tangible storage device 830.
Furthermore, each set of internal components 800a and 800b also includes a network adapter or interface 836 such as TCP/IP adapter card, wireless wi-fi interface card, or 3G or 4G wireless interface card or other wired or wireless communication link. Client software 130 and vulnerabilities detection program 140 on client computer 105a; and server software program 150 having web services 155 on server computer 105b can be downloaded to respective computers 105a and 105b from an external computer or external storage device via a network (for example, the Internet, a LAN, or a WAN) and respective network adapters or interfaces 836. From the network adapter or interface 836, client software 130 and vulnerabilities detection program 140 on client computer 105a; and server software program 150 having web services 155 on server computer 105b are loaded into respective hard drive or computer readable tangible storage device 830. The network may comprise copper wires, optical fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or servers.
Each set of external components 900a and 900b can include a computer display monitor 920, a keyboard 930, and a computer mouse 934. External components 900a and 900b can also include touch screens, virtual keyboards, touch pads, pointing devices, and other human interface devices. Each set of internal components 800a and 800b also includes device drivers 840 to interface to computer display monitor 920, keyboard 930 and computer mouse 934. The device drivers 840, R/W drive or interface 832 and network adapter or interface 836 comprise hardware and software in which the software is stored in computer readable tangible storage device 830 and/or ROM 824.
It should be appreciated that
In accordance with the foregoing, a method, a computer system, and a computer program product have been disclosed for identifying stored vulnerabilities in a web service. However, numerous modifications and substitutions can be made without deviating from the scope of an embodiment of the invention. Therefore, one or more embodiments of the invention have been disclosed by way of example and not limitation.