一句话：提出 Rivulet，复用开发者测试监控信息流，并用白盒测试生成验证注入漏洞可利用性。
代码注入漏洞日益常见，但静态检测误报多，动态检测在生产环境运行开销高。本文提出 Rivulet，一种结合开发者测试套件与自动化动态分析的方法：它先监控开发者编写的功能测试执行，识别可能易受攻击的信息流；再通过白盒测试生成技术改造这些功能测试，以检查脆弱信息流是否可被实际利用。作者在 2017 年 Equifax 攻击所利用的 Apache Struts 版本上评估 Rivulet，仅使用当时 Struts 已有测试便快速识别出该漏洞；与最先进静态漏洞检测器 Julia 在基准上比较，Rivulet 在误报和漏报两方面均更优，并用其发现了新漏洞。
Code injection attacks, like the one used in the high-profile 2017 Equifax breach, have become increasingly common, now ranking #1 on OWASP's list of critical web application vulnerabilities. Static analyses for detecting these vulnerabilities can overwhelm developers with false positive reports. Meanwhile, most dynamic analyses rely on detecting vulnerabilities as they occur in the field, which can introduce a high performance overhead in production code. This paper describes a new approach for detecting injection vulnerabilities in applications by harnessing the combined power of human developers' test suites and automated dynamic analysis. Our new approach, Rivulet, monitors the execution of developer-written functional tests in order to detect information flows that may be vulnerable to attack. Then, Rivulet uses a white-box test generation technique to repurpose those functional tests to check if any vulnerable flow could be exploited. When applied to the version of Apache Struts exploited in the 2017 Equifax attack, Rivulet quickly identifies the vulnerability, leveraging only the tests that existed in Struts at that time. We compared Rivulet to the state-of-the-art static vulnerability detector Julia on benchmarks, finding that Rivulet outperformed Julia in both false positives and false negatives. We also used Rivulet to detect new vulnerabilities.
DOI 原文 ·
@inproceedings{paperbot5674,
title = {Revealing injection vulnerabilities by leveraging existing tests},
author = {Katherine Hough and Gebrehiwet Welearegai and Christian Hammer and Jonathan Bell},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380326}
}