WO2022143145A1

WO2022143145A1 - Over-permission loophole detection method and apparatus

Info

Publication number: WO2022143145A1
Application number: PCT/CN2021/137814
Authority: WO
Inventors: 王伟; 张超; 司琛芝
Original assignee: 北京沃东天骏信息技术有限公司; 北京京东世纪贸易有限公司
Priority date: 2021-01-04
Filing date: 2021-12-14
Publication date: 2022-07-07
Also published as: CN113779585B; CN113779585A

Abstract

An over-permission loophole detection method and apparatus, which relate to the field of network security. The method comprises: capturing an access request of a web application; collecting database access information involved in the access request; capturing an access response corresponding to the access request; determining whether the access request, the access response and the database access information comprise pre-set sensitive information, so as to obtain a first determination result; determining whether a data access process of the access request matches a pre-set compliance model, so as to obtain a second determination result; and according to the first determination result and the second determination result, determining whether an over-permission loophole is present. During a web application access process, related access information is automatically captured and collected, and whether an over-permission loophole is present during the web application access process is determined according to a determination result indicating whether the access information comprises sensitive information and a determination result indicating whether the access process matches a compliance model, thereby realizing an over-permission loophole detection solution with good universality, by means of which automatic detection can be performed.

Description

Ultraviolet vulnerability detection method and device

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is based on the CN application number 202110003407.X and the filing date is January 4, 2021, and claims its priority, the disclosure content of this CN application is hereby incorporated into this application as a whole.

technical field

The present disclosure relates to the field of network security, and in particular, to a method and device for detecting an unauthorized vulnerability.

Background technique

The occurrence of unauthorized vulnerabilities is generally caused by the use of data or resources beyond the user's authority.

In some related technologies, unauthorized vulnerabilities are detected by manual code review. However, the efficiency of manual detection is low, and it is limited by the professional level of the testing personnel.

In other related technologies, an unauthorized vulnerability is detected by simulating whether a low-privileged user (such as a common user) can access a URL (Uniform Resource Locator) of a high-privileged user (such as an administrator). Users with different permissions and different URLs need to be preset, and the results of the request need to be compared in a targeted manner, which has poor generality.

In other related technologies, all accessible page sets and page sets with limited access are collected, and then simulated access is performed on these pages, and unauthorized vulnerabilities are detected by comparing the simulated access results with the actual access rights of these pages. The page addresses need to be classified first, and simulated access is performed one by one, which requires a lot of work and poor versatility.

SUMMARY OF THE INVENTION

The purpose of the embodiments of the present disclosure is to propose a universal unauthorized vulnerability detection scheme capable of automatic detection.

An embodiment of the present disclosure proposes a method for detecting an unauthorized vulnerability, including:

Capture web application access requests;

Collect database access information related to the access request;

Capture the access response corresponding to the access request;

Judging whether the access request, the access response and the database access information include preset sensitive information to obtain a first judgment result;

Judging whether the data access process of the access request matches the preset compliance model, and obtains the second judgment result;

According to the first judgment result and the second judgment result, it is determined whether there is an unauthorized loophole.

In some embodiments, capturing the access request of the web application includes:

The object of the access request is acquired, an instance of the access request is created based on the object of the access request, and the address of the instance of the access request is set as the address of a detector for unauthorized vulnerability detection.

In some embodiments, collecting database access information involved in the access request includes:

Record the database operation command details, code execution context and return value details involved in the access request based on the hook technology;

The database metadata information is recorded based on the modified database connection function, wherein the modified database connection function inserts a database metadata information query command after the original database connection operation.

In some embodiments, capturing an access response corresponding to the access request includes:

Identify and obtain the access response corresponding to the access request by identifying and acquiring the access response corresponding to the access request through the key-value pair identifier added to the header of the access request and the header of the access response;

The object of the access response is acquired, and an instance of the access response is created based on the object of the access response, and the address of the instance of the access response is set as the address of a detector for unauthorized vulnerability detection.

In some embodiments, determining whether the access request, the access response and the database access information include preset sensitive information includes:

associating a parameter list of the access request, the access response, and the database access information with database metadata information;

Match the associated database metadata information with the preset sensitive information. If it matches, determine that the sensitive information is included, and output the parameters associated with the database metadata information that matches the preset sensitive information. If it does not match, determine that it does not. Include sensitive information.

In some embodiments, determining whether the data access process of the access request matches a preset compliance type includes:

Judging whether the data access process of the access request conforms to the standard access process conforming to the size constraints and the standard parameters that should be involved in the standard access process;

If all of them match, it is determined that the data access process of the access request matches the compliance model, and if any one of them does not match, it is determined that the data access process of the access request does not match the compliance model.

In some embodiments, according to the first judgment result and the second judgment result, determining whether there is an unauthorized loophole includes:

If the preset sensitive information is included and does not match the preset compliance type, it is determined that there is an unauthorized vulnerability;

If the preset sensitive information is not included and matches the preset compliance type, it is determined that there is no unauthorized vulnerability;

If it includes pre-set sensitive information, or does not match pre-set compliance types, it is determined that there is a risk of an unauthorized vulnerability.

In some embodiments, the database connection function is modified through the insertAfter operation of the hookMethod method.

In some embodiments, it is performed by a proxy provided in the web application system: capturing the access request of the web application; collecting the database access information involved in the access request; capturing the access response corresponding to the access request; detecting by unauthorized vulnerability detection Execution: judging whether the access request, the access response and the database access information include preset sensitive information, to obtain the first judgment result; judging whether the data access process of the access request complies with the preset regulations The model is matched to obtain a second judgment result; according to the first judgment result and the second judgment result, it is determined whether there is an unauthorized loophole.

Some embodiments of the present disclosure provide an apparatus for detecting an unauthorized vulnerability, including:

The proxy set in the web application system is configured to capture the access request of the web application; collect the database access information involved in the access request; capture the access response corresponding to the access request;

A detector for unauthorized vulnerability detection is configured to judge whether the access request, the access response and the database access information include preset sensitive information, and obtain a first judgment result; judge the data access process of the access request Whether it matches the preset compliance type, a second judgment result is obtained; according to the first judgment result and the second judgment result, it is determined whether there is an unauthorized loophole.

In some embodiments, the agent is configured to:

Capturing the access request of the web application includes: acquiring the object of the access request, creating an instance of the access request based on the object of the access request, and setting the address of the instance of the access request to the address of the unauthorized vulnerability detection detector address;

Or, for collecting the database access information involved in the access request, including: recording the database operation command details, code execution context and return value details involved in the access request based on the hook technology, and recording database metadata information based on the modified database connection function , wherein the modified database connection function inserts a database metadata information query command after the original database connection operation;

Or, for capturing the access response corresponding to the access request, it includes: identifying and acquiring the access response corresponding to the access request by identifying and acquiring the access response corresponding to the access request through the key-value pair identifier added in the header of the access request and the header of the access response, and obtaining the The object of the access response, an instance of the access response is created based on the object of the access response, and the address of the instance of the access response is set as the address of the detector for unauthorized vulnerability detection.

In some embodiments, the detector is configured to:

For obtaining the first judgment result, the method includes: associating the access request, the access response and the parameter list of the database access information with database metadata information, and associating the associated database metadata information with preset sensitive information Matching is performed, if it matches, it is determined that sensitive information is included, and the parameters associated with the database metadata information matching the preset sensitive information are output, and if it does not match, it is determined that sensitive information is not included;

Or, in order to obtain the second judgment result, including: judging whether the data access process of the access request conforms to the standard access process and the standard parameters that should be involved in the standard access process conforming to the size constraint, if all are met, determine the match, if any one If the item does not match, it is judged that it does not match;

Or, for determining whether there is an unauthorized vulnerability, including: if the preset sensitive information is included and does not match the preset compliance type, it is determined that there is an unauthorized vulnerability, if the preset sensitive information is not included, and the preset compliance type is not included. Scale type matching, it is determined that there is no unauthorized vulnerability. If the preset sensitive information is included or does not match the preset compliance type, it is determined that there is a risk of unauthorized vulnerability.

Some embodiments of the present disclosure provide an unauthorized vulnerability detection apparatus, including: a memory; and a processor coupled to the memory, the processor configured to execute any one of the embodiments based on instructions stored in the memory The method for detecting an unauthorized vulnerability is described.

Some embodiments of the present disclosure provide a non-transitory computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, implements the steps of the method for detecting an unauthorized vulnerability described in any one of the embodiments.

The embodiment of the present disclosure automatically captures and collects relevant access information during the web application access process, and determines whether there is an unauthorized vulnerability in the web application access process according to the judgment result of whether the access information includes sensitive information and whether the access process matches the compliance type. Thereby, a universal unauthorized vulnerability detection scheme capable of automatic detection is realized.

Description of drawings

The accompanying drawings that are required to be used in the description of the embodiments or related technologies will be briefly introduced below. The present disclosure will be more clearly understood from the following detailed description with reference to the accompanying drawings.

Obviously, the drawings in the following description are only some embodiments of the present disclosure, and for those of ordinary skill in the art, other drawings can also be obtained from these drawings without creative effort.

FIG. 1 shows a schematic diagram of a deployment solution for unauthorized vulnerability detection according to some embodiments of the present disclosure.

FIG. 2 shows a schematic flowchart of an unauthorized vulnerability detection method according to some embodiments of the present disclosure.

FIG. 3 is a schematic structural diagram of an unauthorized vulnerability detection apparatus according to some embodiments of the present disclosure.

FIG. 4 is a schematic structural diagram of an unauthorized vulnerability detection apparatus according to other embodiments of the present disclosure.

Detailed ways

The technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present disclosure.

Unless otherwise specified, descriptions such as "first" and "second" in the present disclosure are used to distinguish different objects, and are not used to express meanings such as size or timing.

As shown in FIG. 1 , there are web applications that can be accessed by users in a web (World Wide Web, global wide area network, also known as the World Wide Web) application system. In the process of users accessing the web application, the web application system uses IAM (Identity and Access Management, identity recognition and access management) to identify and access users. After the authentication is passed, the corresponding data or resources are provided through the database. . Deploy an agent in the web application system, and deploy a detector for unauthorized vulnerability detection outside the web application system. The hook function is set in the proxy. The agent uses the hook function to automatically capture (hook) and collect the relevant access information in the process of the user accessing the web application in the system, and forward it to the detector. The detector determines whether there is an unauthorized vulnerability in the access process of the web application according to the judgment result of whether the access information includes sensitive information and whether the access process matches the compliance type. Thereby, a universal unauthorized vulnerability detection scheme capable of automatic detection is realized. In addition, a console can also be set, and administrators can control the task of unauthorized vulnerability detection through the console, for example, setting the number of access users for concurrent detection, and setting the unauthorized vulnerability detection for specific applications. Administrators can also view the results of unauthorized vulnerability detection through the console.

As shown in FIG. 2 , the method for detecting unauthorized vulnerability includes: steps 210-260. The unauthorized vulnerability detection method is performed by, for example, an unauthorized vulnerability detection device, wherein steps 210-230 can be executed by a proxy provided in the web application system, and steps 240-260 can be executed by a detector for unauthorized vulnerability detection.

In step 210, the access request of the web application is captured.

The proxy obtains the object of the access request through the hook function, creates an instance of the access request based on the object of the access request, and sets the address of the instance of the access request to the address of the detector for unauthorized vulnerability detection, so as to forward the instance of the access request to the detector.

The related methods of the access request are generally placed in the specified directory, such as org/apache/catalina/. The hook function obtains the related methods of the access request from this directory, such as onInputStreamRead, ApplicationFilterChain, etc.

At step 220, database access information related to the access request is collected.

The agent records database access information such as database operation command details, code execution context (caller, calling parameters, etc.) and return value details involved in the access request based on the hook technology, records database metadata information based on the modified database connection function, and sends it to the detection device. The modified database connection function (such as connection) inserts database metadata information query commands (such as show tables) after the original database connection operation, and obtains the database metadata information in operation through these commands. For example, modify the database connection function through the insertAfter operation of the hookMethod method of Javassist.

The related methods of the access request are generally placed in the specified directory, such as com/mysql/jdbc. The hook function obtains various database access information from this directory, such as connection, execute, executeQuery, executeUpdate, checkSqlQueryResult, etc.

In step 230, an access response corresponding to the access request is captured.

A key-value pair identifier is added to the header of the access request and the header of the access response, and the access request and its corresponding access response are associated through the key-value pair identifier.

The proxy identifies and obtains the access response corresponding to the access request through the key-value pair identifier added to the header of the access request and the header of the access response, obtains the object of the access response, creates an instance of the access response based on the object of the access response, and accesses the response. The address of the instance of is set to the address of the Detector for Override Vulnerability Detection so that the instance of the access response is forwarded to the detector.

The related methods of accessing the response are generally placed in the specified directory, such as org/apache/catalina/. The hook function obtains access response related methods from this directory, such as OutputBuffer, sendRedirect, sendError, etc.

After step 230, steps 240 and 250 may be performed in parallel, or step 240 may be performed first and then step 250 may be performed, or step 250 may be performed first and then step 240 may be performed.

In step 240, it is judged whether the access request, the access response and the database access information include preset sensitive information, and a first judgment result is obtained.

Associate the parameter list of the access request, the access response and the database access information with the database metadata information, and match the associated database metadata information with the preset sensitive information. The set sensitive information matches the parameters associated with the database metadata information. If it does not match, it is determined that the sensitive information is not included.

When appealing the associated operation, disassemble the parameter string of the access request/access response into key-value pairs. For example, the parameter string a=1&b=2 of the get/post request is first divided by "&", and then separately Divide with '=', and finally get the key-value pair {"a"="1", "b"="2"}. Then, use the key in the key-value pair to associate with the database metadata information. Since Metadata is data about data, the business meaning of the parameter is clarified through the database metadata information associated with the key of the parameter, which facilitates matching with sensitive information.

Sensitive information includes, but is not limited to, mobile phone number, ID number, detailed address, order number, courier number, etc.

In step 250, it is determined whether the data access process of the access request matches the preset compliance type, and a second determination result is obtained.

The conformity model constrains the standard access process of various access requests and the standard parameters that should be involved in the standard access process. For example, the data query function of a user accessing a certain page of an application involves a query operation on a certain table in the database. Then you need to determine the data operation statement corresponding to the operation and whether there are qualifications associated with the user identity (usually reflected by the where sub-statement of the sql statement).

When the above matches, it is judged whether the data access process of the access request conforms to the standard access process and the standard parameters that should be involved in the standard access process.

In step 260, it is determined whether there is an unauthorized loophole according to the first judgment result and the second judgment result.

If the preset sensitive information is included and does not match the preset compliance type, it is determined that there is an unauthorized vulnerability; if the preset sensitive information is not included, and it matches the preset compliance type, it is determined that there is no unauthorized vulnerability; if If it includes preset sensitive information or does not match the preset compliance type, it is determined that there is a risk of unauthorized vulnerability, which can be further determined in combination with other methods (such as manual detection or other automatic unauthorized vulnerability detection methods).

In the above embodiment, during the web application access process, relevant access information is automatically captured and collected, and whether there is an unauthorized vulnerability in the web application access process is determined according to the judgment result of whether the access information includes sensitive information and whether the access process matches the compliance type, Thereby, a universal unauthorized vulnerability detection scheme capable of automatic detection is realized. In addition, the detection of horizontal unauthorized vulnerability is realized through sensitive information detection, and the vertical unauthorized vulnerability detection is realized through conformity type matching. The comprehensive unauthorized vulnerability detection is beneficial to improve the accuracy of unauthorized vulnerability detection.

As shown in Fig. 3, the apparatus 300 of this embodiment includes: a proxy 310 set in the web application system and a detector 320 for detecting unauthorized loopholes. The detector 320 may be, for example, in the form of a plug-in implementation.

The proxy 310 set in the web application system is configured to capture the access request of the web application; collect the database access information involved in the access request; and capture the access response corresponding to the access request.

The unauthorized vulnerability detection detector 320 is configured to determine whether the access request, the access response and the database access information include preset sensitive information, and obtain a first determination result; determine the data access of the access request Whether the process matches the preset compliance type, a second judgment result is obtained; according to the first judgment result and the second judgment result, it is determined whether there is an unauthorized loophole.

In some embodiments, the proxy 310 is configured to: obtain the object of the access request, create an instance of the access request based on the object of the access request, and the address of the instance of the access request is set as the detection of unauthorized vulnerability detection address of the device.

In some embodiments, the agent 310 is configured to: record the database operation command details, code execution context and return value details involved in the access request based on the hook technology, and record database metadata information based on the modified database connection function, wherein all The modified database connection function described above inserts database metadata information query commands after the original database connection operation.

In some embodiments, the proxy 310 is configured to: identify and acquire the access response corresponding to the access request by identifying and acquiring the access response corresponding to the access request, and acquire the access response object, an instance of the access response is created based on the object of the access response, and the address of the instance of the access response is set as the address of a detector for unauthorized vulnerability detection.

In some embodiments, the detector 320 is configured to associate a parameter list of the access request, the access response, and the database access information with database metadata information, and associate the associated database metadata information with the pre-defined database metadata information. The preset sensitive information is matched. If it matches, it is determined that the sensitive information is included, and the parameters associated with the database metadata information matching the preset sensitive information are output. If it does not match, it is determined that the sensitive information is not included.

In some embodiments, the detector 320 is configured to: determine whether the data access process of the access request conforms to the standard access process and the standard parameters that should be involved in the standard access process conforming to the size constraints, and if both conform, determine that it matches, if If any of the items do not match, it will be judged that they do not match.

In some embodiments, the detector 320 is configured to: if the preset sensitive information is included and does not match the preset compliance type, determine that there is an unauthorized vulnerability, if the preset sensitive information is not included and does not match the preset compliance type It is determined that there is no unauthorized vulnerability. If the preset sensitive information is included, or it does not match the preset compliance model, it is determined that there is a risk of unauthorized vulnerability.

As shown in FIG. 4 , the apparatus 400 of this embodiment includes: a memory 410 and a processor 420 coupled to the memory 410 , the processor 420 is configured to execute any of the foregoing embodiments based on instructions stored in the memory 410 The method of overriding vulnerability detection.

For example, the processor 420 captures the access request of the web application; collects the database access information involved in the access request; captures the access response corresponding to the access request; determines the access request, the access response and the database access information Whether the preset sensitive information is included, obtain a first judgment result; judge whether the data access process of the access request matches the preset compliance type, and obtain a second judgment result; according to the first judgment result and the first judgment result 2. Judging the results to determine whether there is an unauthorized loophole.

The memory 410 may include, for example, a system memory, a fixed non-volatile storage medium, and the like. The system memory stores, for example, an operating system, an application program, a boot loader (Boot Loader), and other programs.

The apparatus 400 may also include an input-output interface 430, a network interface 440, a storage interface 450, and the like. These

interfaces

430 , 440 , 450 and the memory 410 and the processor 420 can be connected, for example, through a bus 460 . The input and output interface 430 provides a connection interface for input and output devices such as a display, a mouse, a keyboard, and a touch screen. Network interface 440 provides a connection interface for various networked devices. The storage interface 450 provides a connection interface for external storage devices such as SD cards and U disks.

An embodiment of the present disclosure provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, implements the steps of an unauthorized vulnerability detection method.

As will be appreciated by one skilled in the art, embodiments of the present disclosure may be provided as a method, system, or computer program product. Accordingly, the present disclosure may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present disclosure may take the form of a computer program product embodied on one or more non-transitory computer readable storage media having computer program code embodied therein, including but not limited to disk storage, CD-ROM, optical storage, etc. .

The present disclosure is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the disclosure. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

The above descriptions are only preferred embodiments of the present disclosure, and are not intended to limit the present disclosure. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present disclosure shall be included in the protection of the present disclosure. within the range.

Claims

An unauthorized vulnerability detection method, comprising:

Capture web application access requests;

Collect database access information related to the access request;

Capture the access response corresponding to the access request;

Judging whether the access request, the access response and the database access information include preset sensitive information to obtain a first judgment result;

Judging whether the data access process of the access request matches the preset compliance model, and obtains a second judgment result;

According to the first judgment result and the second judgment result, it is determined whether there is an unauthorized loophole.
The method according to claim 1, wherein capturing the access request of the web application comprises:

The object of the access request is acquired, an instance of the access request is created based on the object of the access request, and the address of the instance of the access request is set as the address of a detector that performs unauthorized vulnerability detection.
The method according to claim 1, wherein collecting the database access information involved in the access request comprises:

Record the database operation command details, code execution context and return value details involved in the access request based on the hook technology;

The database metadata information is recorded based on the modified database connection function, wherein the modified database connection function inserts a database metadata information query command after the original database connection operation.
The method of claim 1, wherein capturing an access response corresponding to the access request comprises:

Identify and obtain the access response corresponding to the access request by identifying and acquiring the access response corresponding to the access request through the key-value pair identifier added to the header of the access request and the header of the access response;

The object of the access response is acquired, and an instance of the access response is created based on the object of the access response, and the address of the instance of the access response is set as the address of a detector for unauthorized vulnerability detection.
The method according to claim 1, wherein determining whether the access request, the access response and the database access information include preset sensitive information comprises:

associating a parameter list of the access request, the access response, and the database access information with database metadata information;

Match the associated database metadata information with the preset sensitive information. If it matches, determine that the sensitive information is included, and output the parameters associated with the database metadata information that matches the preset sensitive information. If it does not match, determine that it does not. Include sensitive information.
The method according to claim 1, wherein judging whether the data access process of the access request matches a preset compliance type comprises:

Judging whether the data access process of the access request conforms to the standard access process that conforms to the size constraints and the standard parameters that should be involved in the standard access process;

If all are in conformity, it is determined that the data access process of the access request matches the conformity model, and if any one of them is not conformed, it is determined that the data access process of the access request does not match the conformity model.
The method according to claim 1, wherein, according to the first judgment result and the second judgment result, determining whether there is an unauthorized loophole comprises:

If the preset sensitive information is included and does not match the preset compliance type, it is determined that there is an unauthorized vulnerability;

If the preset sensitive information is not included and matches the preset compliance type, it is determined that there is no unauthorized vulnerability;

If it includes pre-set sensitive information, or does not match pre-set compliance types, it is determined that there is a risk of an unauthorized vulnerability.
The method according to claim 3, wherein the database connection function is modified through the insertAfter operation of the hookMethod method.
The method according to any one of claims 1-8, wherein,

Executed by the proxy set in the web application system: capturing the access request of the web application; collecting the database access information involved in the access request; capturing the access response corresponding to the access request;

Executed by a detector for unauthorized vulnerability detection: judging whether the access request, the access response and the database access information include preset sensitive information, and obtaining a first judgment result; judging whether the data access process of the access request is not Matching with a preset compliance type, a second judgment result is obtained; according to the first judgment result and the second judgment result, it is determined whether there is an unauthorized loophole.
An unauthorized vulnerability detection device, comprising:

The proxy set in the web application system is configured to capture the access request of the web application; collect the database access information involved in the access request; capture the access response corresponding to the access request;

A detector for unauthorized vulnerability detection is configured to determine whether the access request, the access response and the database access information include preset sensitive information, and obtain a first determination result; determine the data access process of the access request Whether it matches the preset compliance type, a second judgment result is obtained; according to the first judgment result and the second judgment result, it is determined whether there is an unauthorized loophole.
The apparatus of claim 10, wherein the agent is configured to:

For capturing the access request of the web application, the method includes: obtaining the object of the access request, creating an instance of the access request based on the object of the access request, and setting the address of the instance of the access request to the address of the unauthorized vulnerability detection detector. address;

Or, for collecting the database access information involved in the access request, including: recording the database operation command details, code execution context and return value details involved in the access request based on the hook technology, and recording database metadata information based on the modified database connection function , wherein the modified database connection function inserts a database metadata information query command after the original database connection operation;

Or, for capturing the access response corresponding to the access request, it includes: identifying and acquiring the access response corresponding to the access request by identifying and acquiring the access response corresponding to the access request through the added key-value pair identifier in the header of the access request and the header of the access response, and acquiring the The object of the access response, an instance of the access response is created based on the object of the access response, and the address of the instance of the access response is set as the address of the detector for unauthorized vulnerability detection.
The apparatus of claim 10, wherein the detector is configured to:

For obtaining the first judgment result, the method includes: associating the access request, the access response and the parameter list of the database access information with database metadata information, and associating the associated database metadata information with preset sensitive information Matching is performed, if it matches, it is determined that sensitive information is included, and the parameters associated with the database metadata information matching the preset sensitive information are output, and if it does not match, it is determined that sensitive information is not included;

Or, in order to obtain the second judgment result, it includes: judging whether the data access process of the access request conforms to the standard access process and the standard parameters that should be involved in the standard access process conforming to the size constraints, if all are met, determine the match, if any one If the item does not match, it is judged that it does not match;

Or, for determining whether there is an unauthorized vulnerability, including: if the preset sensitive information is included and does not match the preset compliance type, it is determined that there is an unauthorized vulnerability, if the preset sensitive information is not included, and the preset compliance type is not included. Scale type matching, it is determined that there is no unauthorized vulnerability, if the preset sensitive information is included or does not match the preset compliance type, it is determined that there is a risk of unauthorized vulnerability.
An unauthorized vulnerability detection device, comprising:

memory; and

A processor coupled to the memory, the processor configured to perform the unauthorized vulnerability detection method of any one of claims 1-9 based on instructions stored in the memory.
A non-transitory computer-readable storage medium on which a computer program is stored, when the program is executed by a processor, implements the steps of the method for detecting an unauthorized vulnerability according to any one of claims 1-9.