| 孟海宁,陆杰,李昊峰,黄永恒,曹立庆,李炼.Web应用访问控制漏洞检测研究进展[J].高技术通讯(中文),2025,35(3):227~240 |
| Web应用访问控制漏洞检测研究进展 |
| A survey of Web application access control vulnerability detection |
| |
| DOI：10. 3772 / j. issn. 1002-0470. 2025. 03. 001 |
| 中文关键词: Web应用； 访问控制； 访问控制漏洞； 漏洞检测； 越权访问； 软件缺陷检测 |
| 英文关键词: Web application, access control, access control vulnerabilities, vulnerability detection, unauthorized access, software flaw detection |
| 基金项目: |
| 作者 | 单位 | | 孟海宁 | （中国科学院计算技术研究所处理器芯片全国重点实验室北京 100190）
（中国科学院大学北京 100049） | | 陆杰 | | | 李昊峰 | | | 黄永恒 | | | 曹立庆 | | | 李炼 | |
|
| 摘要点击次数: 138 |
| 全文下载次数: 98 |
| 中文摘要: |
| 访问控制机制在维护Web应用安全方面扮演着至关重要的角色。然而，不安全的访问控制机制已经成为威胁Web应用安全的主要风险来源之一。为了保护Web应用安全，及早地检测并报告访问控制漏洞至关重要。为了帮助安全研究者和程序开发者更深入地了解Web应用的访问控制漏洞以及现有工作的研究进展，本文对该领域的相关工作进行了系统总结，概括了访问控制漏洞的基本概念与特征，归纳了检测访问控制漏洞的关键步骤和核心思想。此外，本文进一步针对功能级、对象级和对象属性级3类高危访问控制漏洞，详细分析和讨论了现有工作的漏洞检测能力。最后，对Web应用访问控制漏洞检测技术的发展进行了总结与展望。 |
| 英文摘要: |
| Access control plays an important role in maintaining the security of Web applications. However, insecure access control has become one of the biggest threats to Web application security. To protect the security of Web applications, it is crucial to detect and report access control vulnerabilities at an early stage. To provide security researchers and program developers with a deeper understanding of Web application access control vulnerabilities and existing detection technologies, this article systematically summarizes the relevant work in this field, explains the basic concepts and characteristics of access control vulnerabilities, and explains the main steps and core ideas for detecting access control vulnerabilities. In addition, this paper analyzes and discusses in detail the vulnerability detection capabilities in existing work for three types of high-risk access control vulnerabilities at the function, object, and object attribute levels. Finally, the development of Web application access control vulnerability detection technology is summarized and the future research directions are given. |
|
查看全文
查看/发表评论 下载PDF阅读器 |
| 关闭 |
|
|
|
