I'm a professional pentester and generally conduct a lot of webapplication assessments where we use the described techniques for detecting vulnerabilities. These techniques are not new and the patent basically describes the general approach every pentester uses to assess their web applications.
In my eyes the patent granted is a bit like as if someone suddenly would take a patent on writing words to a piece of paper with pen using the latin alphabet. It does not make sense to me that this exists and was granted in the first place.
I wonder what this patent effetively means for all security professionals performing security assessments on Web Applications (or creators of automated tools such as Portswigger's Burp or OWASP's Zed Attack Proxy (ZAP)). Are we to be worried that IBM can start demanding money for creating automated tools using these techniques or even from consultants?
- A system comprising: a black-box tester comprising a hardware processor configured to interact with a web application during its execution to identify a web page exposed by the web application, the web application being hosted by a server and accessible by a client computer; a constraint manager configured to: receive the web page identified by the black-box tester; statically analyze the web page to identify a hidden parameter within the web page that is constrained by a client-side validation measure and that is to be sent to the web application, the hidden parameter to indicate an authorization level of a user of the client computer; and determine a server-side validation measure to be applied to the hidden parameter comprising the web application checking for a correlation between a value of the hidden parameter and a value of at least one other parameter from the user; and a static analyzer configured to: statically analyze the web application to identify a location within the web application where the hidden parameter is input into the web application; query the constraint manager for the server-side validation measure to be applied to the hidden parameter; determine whether the web application checks for the correlation between the value of the hidden parameter and the value of the least one other client-supplied parameter according to the server-side validation measure from the constraint manager prior to the hidden parameter being used in a security-sensitive operation; and identify the hidden parameter as a security vulnerability where the web application does not check for the correlation between the value of the hidden parameter and the value of the at least one other client-supplied parameter prior to the hidden parameter being used in the security-sensitive operation.
- The system of claim 1 wherein the static analyzer is further configured to statically analyze the web application by building a control-flow model and a data-flow model of the web application.