WO2013065087A1

WO2013065087A1 - Diagnostic device

Info

Publication number: WO2013065087A1
Application number: PCT/JP2011/006137
Authority: WO
Inventors: 雅之久田
Original assignee: 株式会社Ｎｓｔ
Priority date: 2011-11-02
Filing date: 2011-11-02
Publication date: 2013-05-10

Abstract

An information analysis device (200) generates and sends a diagnosis request to an application to be diagnosed (318). On the basis of said request, an information gathering device (300) acquires a generated SQL query. The information analysis device (200) checks whether a special character set in an SQL query conditional clause has been escape-processed, thereby determining whether vulnerability exists. Moreover, the information analysis device (200) checks whether the syntax of the SQL query based on the diagnosis request is different from the syntax of an SQL query based on a normal request, and determines whether vulnerability exists. In addition, by checking whether the query based on the diagnosis request is a syntax error, said information analysis device (200) determines whether vulnerability exists.

Description

Diagnostic equipment

The present invention relates to data processing technology, and more particularly to an apparatus for diagnosing application vulnerabilities.

Among the information leakage incidents caused by application vulnerabilities, there are many incidents caused by injection attacks that cause information leakage and information falsification by interfering with the database, and there is a strong tendency for damage to occur. According to “Cyber Security Trend Analysis Report 2010” compiled by NRI Secure Technologies, Inc., SQL injection vulnerabilities have been detected in 17% of those judged to be unauthorized access in Web application diagnosis. In addition, according to the “Information Security Event Damage Survey for Enterprises” compiled by the Information-technology Promotion Agency of Japan, the cost of recovery and response to unauthorized access that exploits the vulnerability of SQL injection starts at 50 million yen per company. It is estimated to be over 100 million yen. Under such circumstances, security diagnosis to detect application vulnerabilities is extremely important to prevent damage.

As a technique for detecting vulnerabilities, a method is known in which a pseudo-attack data is embedded in a request to an application, and whether a response includes a known pattern that occurs when the attack is established (for example, , See Patent Document 1).

JP 2008-299540 A

However, depending on the application, it may not be possible to detect vulnerabilities by simply checking the response. For example, if there is a vulnerability, even if a request with embedded pseudo-attack data that causes an error to be sent to the database is sent, depending on the application error handling, there is a vulnerability on the client side. Traces may not return. As a result, there may be a case where a vulnerability is not detected.

The present invention has been made in view of these problems, and a main purpose thereof is to provide a technique that can contribute to improving the reliability of vulnerability detection of applications.

In order to solve the above problems, a diagnostic device according to an aspect of the present invention is a device for diagnosing the vulnerability of an application that issues a query to a database, and includes a plurality of types including special characters predetermined in the database Judgment that a vulnerability exists when a special character is set in a conditional clause without escaping in the query generated by the supply unit that supplies the request to the application and the application that acquired the request A section.

It should be noted that any combination of the above-described constituent elements and the expression of the present invention converted between a method, a system, a program, a recording medium storing the program, etc. are also effective as an aspect of the present invention.

According to the present invention, it is possible to contribute to improving the reliability of application vulnerability detection.

It is a figure which shows the process of the diagnosis in this Embodiment. It is a figure which shows the function and structure of the diagnostic apparatus of embodiment. It is a figure which shows the example of a normal request and a diagnostic request. It is a figure which shows the data structure of the request holding part of FIG. It is a figure which shows the data structure of the query holding | maintenance part of FIG. It is a figure which shows the SQL query based on a normal request, and its syntax tree. It is a figure which shows the SQL query based on a diagnostic request, and its syntax tree. It is a figure which shows the SQL query based on a diagnostic request, and its syntax tree. It is a figure which shows the SQL query based on a diagnostic request, and its syntax tree. It is a figure which shows the SQL query based on a diagnostic request, and its syntax tree. It is a figure which shows the SQL query based on a diagnostic request. It is a figure which shows the diagnostic result displayed by the result display part of FIG. It is a flowchart which shows the operation | movement in the patrol phase of the diagnostic apparatus of embodiment. It is a flowchart which shows the operation | movement in the test case production | generation phase of the diagnostic apparatus of embodiment. It is a flowchart which shows the operation | movement in the test phase of the diagnostic apparatus of embodiment. It is a flowchart which shows the operation | movement in the analysis phase of the diagnostic apparatus of embodiment.

The outline of the diagnostic apparatus according to the embodiment is as follows.
This apparatus diagnoses whether or not there is a vulnerability in the Web application by confirming the content of the SQL query generated by the Web application based on the request. For this purpose, this apparatus generates a plurality of types of requests (hereinafter also referred to as “diagnostic requests”) in which pseudo-attack data (character strings including special characters) is set as a parameter, and sends them to the Web application to be diagnosed. Send. This apparatus acquires the SQL query generated by the Web application based on these requests. Then, it is determined whether or not there is a vulnerability by checking whether or not the special character set in the conditional clause of the acquired SQL query has been escaped (hereinafter also referred to as “escape determination”).

In addition, this apparatus uses the syntax of the SQL query generated by the Web application based on the diagnostic request, and a request that is a template and has normal data set as a parameter (hereinafter also referred to as “normal request”). Whether or not the syntax of the SQL query generated by the Web application is different, and determines whether or not there is a vulnerability (hereinafter also referred to as “syntax determination”). Further, it is determined whether or not there is a vulnerability by checking whether or not the SQL query based on the diagnosis request is a syntax error (hereinafter also referred to as “error determination”).

FIG. 1 shows the process of diagnosis in the present embodiment. The diagnosis process is roughly divided into a cyclic phase, a test case generation phase, a test phase, and an analysis phase. Hereinafter, it demonstrates in order.

1. Visiting phase This is the phase in which normal requests that serve as a template for diagnostic requests are acquired. Specifically, the request transmitted when following the links included in the response is acquired as a normal request. Also, an SQL query generated by the Web application based on this normal request is acquired. This SQL query is used in the syntax determination of the analysis phase.

2. Test case generation phase This is the phase in which a diagnostic request is generated. Specifically, various diagnostic requests are generated using the normal request acquired in the patrol phase as a template.

3. Test phase This is a phase in which a pseudo attack is performed. Specifically, a plurality of diagnosis requests generated in the test case generation phase are transmitted to the diagnosis target Web application. Then, an SQL query generated by the Web application based on the diagnosis request is acquired.

4). Analysis phase This phase analyzes whether or not there are vulnerabilities. Specifically, escape determination, syntax determination, and error determination are performed using the SQL queries acquired in the test phase and the cyclic phase.

FIG. 2 shows the function and configuration of the diagnostic apparatus 400 according to the present embodiment. Each of these blocks can be realized in hardware by an element such as a CPU of a computer or a mechanical device, and is realized in software by a computer program or the like, but here, functions realized by their cooperation. Draw a block. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms by a combination of hardware and software.

The diagnosis device 400 is a device for diagnosing the vulnerability of the Web application, and operates the Web application to be diagnosed in this device to diagnose the vulnerability. Diagnosis device 400 includes information analysis device 200 and information collection device 300. The diagnosis device 400 may be a single device that integrally includes the functions of the information analysis device 200 and the information collection device 300, or may be a collection of two devices. The operation terminal 100 is an information processing terminal operated by a person in charge of diagnosis (hereinafter referred to as “diagnosis practitioner”), and receives predetermined information and instructions from the diagnosis practitioner. Then, the information is transmitted to the diagnostic apparatus 400.

The information analysis apparatus 200 includes a circulation unit 210, a pseudo attack data holding unit 220, a request generation unit 230, a request supply unit 240, a response reception unit 250, an association unit 260, a syntax analysis unit 270, a determination unit 280, and a result display unit 290. Including. The information collection device 300 includes an execution environment 310, a request acquisition unit 320, a request holding unit 330, a query acquisition unit 340, and a query holding unit 350.

The traveling unit 210 receives information related to a request serving as a base point from the operation terminal 100 and transmits a request based on the information to the application 318. Further, when a link is included in the response from the application 318, a request is transmitted so as to follow this one after another. Then, the information collection apparatus 300 acquires the request (normal request) transmitted at this time and the SQL query issued by the application 318 based on this request.

The pseudo attack data holding unit 220 holds the pseudo attack data set as parameters when generating a diagnosis request. Here, the “pseudo attack data” is data in which a known attack pattern for confirming the presence or absence of SQL injection vulnerability is set. For example, special characters such as “'(single quotation)” and “%” are used. It is data including.

The request generation unit 230 generates a plurality of diagnosis requests based on a plurality of normal requests that are held in the request holding unit 330 and acquired in the cyclic phase. Specifically, it is generated by replacing the value set in the acquired request parameter with pseudo attack data. A plurality of diagnosis requests are generated from each normal request based on a plurality of pseudo-attack data so that it can be comprehensively checked whether or not there is a vulnerability. FIG. 3A shows an example of a normal request that serves as a template for a diagnostic request, and FIGS. 3B to 3D show diagnostic requests generated based on the normal request of FIG. In the diagnosis request shown in FIG. 3B, the parameter “user1” of the normal request shown in FIG. 3A is replaced with the special character “%”. In FIG. 3C, “pass1” is replaced with “′ or ′ a ′ = ′ a”, and in FIG. 3D, “pass1” is replaced with “pass′1”. Of course, a URL-encoded character string may actually be set as the parameter value. Returning to FIG.

The request supply unit 240 transmits a plurality of diagnosis requests generated by the request generation unit 230 to the application 318. The response receiving unit 250 receives a response from the application 318.

The execution environment 310 is an environment for operating the application 318 to be diagnosed, and includes a Web server 312, an application server 314, and a database server 316. The Web server 312 has a function of transmitting a processing result or the like by a Web application in response to a client request. The application server 314 has a function of executing various business processes by executing a Web application. The database server 316 has a function of searching and outputting information stored in the database in response to a query. Here, it is assumed that the escape character for the database server 316 is “\ (backslash)”. In the application server 314, an application 318 to be diagnosed is arranged. This arrangement is performed by a person who receives a vulnerability diagnosis service. Of course, it may be performed by a diagnosis practitioner who has received an application from that person.

The request acquisition unit 320 provides a so-called HTTP proxy server function, and relays a request for the application 318 from the information analysis apparatus 200. At that time, the request content is acquired and stored in the request holding unit 330. The request acquisition unit 320 acquires both the request transmitted by the traveling unit 210 in the traveling phase and the request transmitted by the request supply unit 240 in the test phase.

The request holding unit 330 holds the request acquired by the request acquisition unit 320. FIG. 4 shows the data structure of the request holding unit 330. The request holding unit 330 holds a request ID for uniquely identifying a held request, a request, and a time stamp at the time of acquisition in association with each other. Note that only requests including a predetermined protocol, host name, and directory path may be held for requests acquired in the patrol phase. For example, if only the request with the protocol “http” and the host name “www.example.co.jp” is retained (no directory path is specified), the diagnosis is sent from the target to which the diagnosis request is sent in the test phase. You can exclude external sites that are not eligible.

The query acquisition unit 340 provides a so-called SQL proxy server function, and relays the SQL query issued by the application 318 to the database. At that time, the contents of the SQL query are acquired and stored in the query holding unit 350.

The query holding unit 350 holds the SQL query acquired by the query acquisition unit 340. FIG. 5 shows the data structure of the query holding unit 350. The query holding unit 350 holds the SQL query ID for uniquely identifying the held SQL query, the SQL query, and the time stamp at the time of acquisition in association with each other.

The associating unit 260 identifies the request based on which request the SQL query was generated. Specifically, the request for the time stamp immediately before the time stamp of the SQL query is specified as the request for the SQL query. For example, assume that the data held in the request holding unit 330 and the query holding unit 350 are in the states shown in FIGS. In this case, the request that is the basis of the SQL query with the SQL query IDs “4” to “5” is identified as the request with the request ID “2” having the immediately preceding time stamp.

The syntax analysis unit 270 performs syntax analysis of the conditional clause of the SQL query held in the query holding unit 350, specifically, creates a syntax tree. For this syntax analysis unit 270, an arbitrary syntax analyzer such as existing syntax analysis software can be used. FIG. 6A shows an SQL query generated based on the normal request shown in FIG. 3A, and FIG. 6B shows its syntax tree. In FIG. 6B, the lowest layer node 10 indicates the lowest layer node, and an operand is assigned. The internal node 20 is a node other than the lowest layer, has a plurality of child nodes, and is assigned an operator. If the SQL query to be parsed is a syntax error, the syntax analysis unit 270 detects that fact. Returning to FIG.

The determination unit 280 performs escape determination using the syntax tree generated by the syntax analysis unit 270. Specifically, the operand of the lowest node of the syntax tree is checked, and if a special character is included, it is checked whether or not it is escaped. FIGS. 7A and 8A are SQL queries generated based on the diagnostic request of FIG. 3B, and there is no SQL injection vulnerability, and there is a vulnerability. SQL query generated in FIGS. 7B and 8B show the syntax trees of the SQL queries in FIGS. 7A and 8A, respectively. In the node 40 of FIG. 7B, the special character “%” is escaped and becomes “\%”. On the other hand, in the corresponding node 50 in FIG. 8B, the special character “%” is set without being escaped. In this case, the determination unit 280 determines that vulnerability exists. Returning to FIG.

Also, the determination unit 280 performs syntax determination using the SQL query based on the normal request and the syntax tree of the SQL query based on the diagnostic request. Specifically, after associating the request with the SQL query generated based on the request by the associating unit 260, the syntax tree of the SQL query based on the normal request and the diagnostic request generated using the normal request as a template It is compared with the syntax tree of the SQL query based on it to check whether the depth and width are different, and whether the operator assigned to the corresponding node is different.

9 (a) and 10 (a) are the SQL queries generated based on the diagnostic request in FIG. 3 (c), and there are no SQL injection vulnerabilities or vulnerabilities, respectively. SQL query generated in Compared to FIG. 6B which is a syntax tree of an SQL query based on a normal request, FIG. 9B has the same depth and width of the syntax tree, that is, the structure of the syntax tree. All operators assigned to internal nodes are the same. On the other hand, FIG. 10B is different in structure because the hierarchy of the dotted line portion is deeper than that in FIG. Further, the operators of the node 30 in FIG. 6B and the node 60 in FIG. 10B which are corresponding internal nodes are “=” and “or”, respectively, and are different. That is, in FIG. 10B, the syntax of the SQL query is different from the SQL query based on the normal request. In this case, the determination unit 280 determines that vulnerability exists. As described above, by performing syntax determination, it is possible to determine whether or not there is a vulnerability even when the syntax is changed by the pseudo attack data and the special character is not included in the operand. Returning to FIG.

Also, the determination unit 280 confirms whether or not an SQL query based on the diagnosis request includes a syntax error, and performs error determination. 11 (a) and 11 (b) are SQL queries generated based on the diagnostic request in FIG. 3 (d), which are generated when there is no SQL injection vulnerability and when there is a vulnerability, respectively. SQL query to be performed. In FIG. 11B, since the special character “′” is not escaped, “pass” is used as a search condition for passwd, and “1 ′” that follows is inappropriate as SQL. Therefore, in FIG. 11B, an error occurs when the syntax analysis unit 270 performs syntax analysis. In this case, the determination unit 280 determines that vulnerability exists. Returning to FIG.

The result display unit 290 displays the diagnosis result on the operation terminal 100. FIG. 12 is a screen showing the diagnosis result displayed by the result display unit 290. A result 70 indicates a diagnosis result of whether or not a vulnerability exists. Detailed information 80 indicates details of the diagnosis result. Specifically, an SQL query that is a basis for a diagnosis result that vulnerability exists, and a result of each determination for the SQL query are shown. In addition, the result of association by the association unit 260 is received, and the request that is the basis of the SQL query is also displayed.

The operation of the diagnostic apparatus 400 having the above configuration will be described. FIG. 13 is a flowchart showing the operation of the diagnostic apparatus 400. 13A shows the operation in the cyclic phase, FIG. 13B shows the operation in the test case generation phase, FIG. 13C shows the operation in the test phase, and FIG. 13D shows the operation in the analysis phase.

As illustrated in FIG. 13A, the traveling unit 210 of the information analysis device 200 transmits, to the application 318, information related to a base request received from the operation terminal 100 or a normal request based on a link included in the response. (S10). The request acquisition unit 320 of the information collection device 300 relays a request to the application 318, and at that time, acquires a normal request and holds it in the request holding unit 330 (S20). Upon receiving the request, the application 318 generates an SQL query and issues it to the database. The query acquisition unit 340 relays the query, and at that time, acquires the SQL query and holds it in the query holding unit 350 (S30). The response receiving unit 250 of the information analysis apparatus 200 receives a response from the application 318 (S40). When a link is included in the response from the application 318, this flow is repeated and a normal request based on the link is transmitted to the application 318. In this way, the normal request and the SQL query based on the normal request are acquired.

As shown in FIG. 13B, the request generation unit 230 of the information analysis apparatus 200 generates a plurality of diagnosis requests based on the plurality of normal requests acquired in the cyclic phase (S50).

As shown in FIG. 13C, the request supply unit 240 of the information analysis apparatus 200 transmits a diagnosis request to the application 318 (S60). The request acquisition unit 320 of the information collection device 300 acquires the diagnosis request and holds it in the request holding unit 330 in the same manner as in the diagnosis phase (S70). The query acquisition unit 340 acquires the SQL query and stores it in the query storage unit 350 (S80). The response receiving unit 250 of the information analysis apparatus 200 receives a response from the application 318 (S90). This flow is repeated for the number of diagnostic requests generated in the test case generation phase. In this way, the diagnosis request and the SQL query based on the diagnosis request are acquired.

13D, the syntax analysis unit 270 of the information analysis device 200 parses the SQL query acquired by the query acquisition unit 340 of the information collection device 300, and generates a syntax tree (S100). The determination unit 280 determines whether to escape the syntax tree appropriately (S110). Next, as compared with the SQL query based on the normal request, it is determined whether or not the syntax has changed (S120). Finally, an error determination is made as to whether or not the SQL query has a syntax error (S130). If any one of the three determinations determines that there is a vulnerability, the Web application to be diagnosed has a vulnerability. The result display unit 290 displays the diagnosis result on the operation terminal 100 (S140).

According to the above configuration, the SQL query generated by the application based on the diagnosis request is confirmed, and it is determined whether or not the SQL injection vulnerability exists. Therefore, the determination can be made without being affected by the creation of the application, and it can be determined whether or not the vulnerability exists more reliably than in the case where the determination is made by checking the response from the application. Also, since we are also looking at whether or not the SQL query has been changed by the pseudo attack data, even if the syntax is changed and the special character is not included in the operand, it is determined whether or not the vulnerability exists. Can do. In addition, it is possible to specify the request based on which request the SQL query was generated based on the time stamp. Then, by specifying the request, it is possible to easily specify in which part of the application the vulnerability exists.

The present invention has been described based on the embodiments. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there.

Modification 1
In the embodiment, an example in which the diagnosis target is a Web application has been described. However, the present invention is not limited thereto, and may be a network application. In this embodiment, an example of diagnosing the vulnerability of SQL injection, that is, an example in which a query issued by an application is an SQL query is shown. However, the present invention is not limited to this, and other queries such as XQuery may be used. Good.

Modification 2
In the embodiment, an example in which the information collection device 300 is a single device having functions of a Web server, an application server, and a database server has been described, but the present invention is not limited to this. Therefore, for example, the Web server, the application server, and the database server may be mounted on physically different devices, and the information collection device 300 may be a collection of them. Of course, it may be an aggregate of a device having any two of the three server functions and a device having the remaining functions. In the embodiment, an example of a three-layer structure including a Web server, an application server, and a database server is shown, but the present invention is not limited to this. Therefore, for example, there is no Web server, and a two-layer structure including an application server and a database server may be used. Also in this case, of course, each server function may be implemented in a physically different device.

Modification 3
In the embodiment, the example in which the determination is made in the order of the escape determination, the syntax determination, and the error determination to determine whether or not the vulnerability exists is shown, but the present invention is not limited to this. Therefore, for example, determination may be made in the order of error determination, syntax determination, and escape determination.

It should also be understood by those skilled in the art that the functions to be performed by the constituent elements described in the claims are realized by the individual constituent elements shown in the embodiments and the modifications or by linking them.

100 operation terminal, 200 information analysis device, 210 patrol unit, 220 pseudo attack data holding unit, 230 request generation unit, 240 request supply unit, 250 response reception unit, 260 association unit, 270 syntax analysis unit, 280 determination unit, 300 information Collection device, 310 execution environment, 320 request acquisition unit, 330 request holding unit, 340 query acquisition unit, 350 query holding unit, 400 diagnostic device.

The present invention can be used for an apparatus for diagnosing application vulnerabilities.

Claims

A device for diagnosing vulnerabilities in applications that issue queries to databases,
A request supply unit that supplies a plurality of types of requests including special characters predetermined in the database to the application;
In the query generated by the application that acquired those requests, a determination unit that determines that a vulnerability exists when a special character is set in a conditional clause without being escaped,
A diagnostic apparatus comprising:
In the determination unit, the syntax of a query generated by an application based on a request in which pseudo attack data is set as a parameter is different from the syntax of a query generated by the application based on a request in which normal data is set as a parameter. The diagnosis apparatus according to claim 1, wherein the diagnosis apparatus determines that the vulnerability exists.
A parsing unit that parses the query and generates a syntax tree of the conditional clause;
The determination unit is a query corresponding to a query syntax tree based on pseudo attack data and a query corresponding to a query syntax tree based on normal data, and different operators assigned to nodes having a plurality of child nodes. The diagnosis apparatus according to claim 2, wherein the syntaxes are determined to be different and it is determined that the vulnerability exists.
The determination unit may determine that a vulnerability exists even when a query that is a syntax error is detected from a query generated by an application based on a request in which pseudo attack data is set as a parameter. The diagnostic device according to any one of 1 to 3.
A request acquisition unit for acquiring a request sent to the application;
A request holding unit that holds the request acquired by the request acquisition unit in association with a time stamp at the time of acquisition;
A query acquisition unit for acquiring a query issued by the application;
A query holding unit that holds the query acquired by the query acquisition unit in association with a timestamp at the time of acquisition;
The diagnosis according to any one of claims 1 to 4, further comprising an associating unit that specifies and provides a request corresponding to a query when it is determined that there is a vulnerability based on each time stamp. apparatus.
A program that diagnoses vulnerabilities in applications that issue queries against databases,
A function for supplying multiple types of requests including special characters predetermined in the database to the application,
In the query generated by the application that acquired those requests, a function that determines that there is a vulnerability when special characters are set in the conditional clause without being escaped,
A computer program for causing a computer to realize the above.