一句话：提出LLM辅助的双向静态污点分析方法STaint，精确建模自定义数据库读写，检测PHP二阶漏洞。
二阶漏洞（如二阶XSS与SSRF）的成因是用户可控输入先被存入数据库、随后在不同执行上下文中被取出使用，这使静态检测变得困难。现有静态分析方法主要面临两个挑战：一是难以准确识别第三方库或自定义数据访问层中访问数据库的函数，导致污点传播路径遗漏；二是当查询由运行时参数动态构造时，难以对数据库操作进行上下文建模。为此，作者提出STaint，一种将污点分析与大语言模型相结合的双向静态分析方法。它借助LLM的语义推理能力识别并建模自定义的数据库读、写操作，从而完整重建跨数据库的污点数据流。在十个真实PHP应用上的初步评估表明，STaint成功检测出56条二阶漏洞路径，其中包含7个此前未知的漏洞，效果优于现有技术。
Second-Order vulnerabilities, such as second-order Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF), occur when user-controlled inputs are stored in databases and later retrieved in different execution contexts, complicating static detection. Existing static analysis approaches struggle primarily with two challenges. First, they struggle in accurately identifying database-accessing functions defined by third-party libraries or custom data access layers, often leading to missed taint propagation paths. Second, they may fail to contextually model database operations when queries are dynamically constructed and depend on runtime parameters. To address these limitations, we propose STaint, a novel bi-directional static analysis method that integrates taint analysis with large language models (LLMs). Using semantic reasoning, STaint accurately identifies and models custom database reads and writes, effectively reconstructing comprehensive taint data flows in the database. Preliminary evaluations on ten real-world PHP applications show that STaint successfully detects 56 second-order vulnerability paths, including 7 previously unknown cases, outperforming existing techniques.
DOI 原文 ·
@inproceedings{paperbot9428,
title = {STaint: Detecting Second-Order Vulnerabilities in PHP Applications with LLM-Assisted Bi-Directional Static Taint Analysis},
author = {Yuchen Ji and Hongchen Cao and Jingzhu He},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00347}
}