基于Fuzzing技术的云数据泄露漏洞检测  

Cloud Data Leak Vulnerability Detection Based on Fuzzing

作　　者：姜百合 傅建明[1,2] 王应军 王亚丽 黄坚伟 JIANG Baihe;FU Jianming;WANG Yingjun;WANG Yali;HUANG Jianwei(Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, Wuhan University, Wuhan 430072, Hubei, China;School of Computer, Wuhan University, Wuhan 430072, Hubei, China;Information Center, 62101 Unit, Wuhan 430072, Hubei, China)

机构地区：[1]武汉大学空天信息安全与可信计算教育部重点实验室,湖北武汉430072 [2]武汉大学计算机学院,湖北武汉430072 [3]62101部队信息中心,湖北武汉430072

出　　处：《武汉大学学报（理学版）》2018年第2期115-120,共6页Journal of Wuhan University:Natural Science Edition

基　　金：国家自然科学基金资助项目(U1636107,61373168,61202387)

摘　　要：目前Web应用上存在接口枚举、越权与敏感信息回传三种逻辑漏洞,在SaaS服务模式的背景下,攻击者利用这些漏洞可以非法获取云端数据,给厂商和用户造成损失.主流的检测方案未实现自动化,依赖测试者经验的渗透测试,难以全面覆盖复杂的Web应用业务逻辑.本文分析云数据服务Web应用的业务逻辑,建立抽象三种逻辑漏洞的威胁模型,设计漏洞Fuzzing检测算法和系统框架,并实现了原型系统.实验结果表明,本文方案可检测造成云数据泄露的三种逻辑漏洞,与人工经验相结合,实现自动化的渗透测试.测试真实Web应用,发现了未被修补的三种逻辑漏洞,并已经得到厂商确认,提升了漏洞挖掘的覆盖度.The business logic vulnerabilities such as interface enumeration,unauthorized access and sensitive information postback widely exist in the present web application,which can be exploited to leak sensitive cloud data under the SaaS service mode,bringing the economic loss to vendors and users.The penetration test,the most popular solution,cannot be applied automatically,for its performance is based on the test experts＇ experience and not perfect enough under the complex web application architecture.In this situation,in this paper we explored how to automatically detect the vulnerabilities which cause the cloud data leak,based on fuzzing.We analyzed and modeled the business logic of cloud data service web applications,provided a threat model of three representative business logic vulnerabilities,designed a vulnerability detection system,and implemented a prototype system.The experimental results show that the solution could detect potential vulnerabilities,and assist security experts to improve performance on coverage in the penetration test.

关 键 词：WEB应用安全 信息泄露 FUZZING测试 业务逻辑漏洞 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]