Vulnerability Report Analysis and Vulnerability Reproduction for Web Applications

With the increasing complexity of Web applications, their security issues happen frequently. Vulnerability reports aim to document security issues of Web applications and assist in improving their security and quality. However, vulnerability reports are usually described in highly unstructured natural language, and the descriptions of vulnerabilities vary considerably. So automatically reproducing vulnerabilities from their reports is a challenging task. To this end, this paper proposes an approach to automatically comprehend vulnerability reports and reproduce vulnerabilities in Web applications. In order to automatically parse vulnerability reports of Web applications, a general syntactic dependency pattern is summarized from diverse vulnerability reports to guide the identification and extraction of key information in vulnerability reports. In particular, payloads in vulnerability reports exist mainly in the form of code fragments, unlike natural language. For this reason, a payload extraction rule is further designed. Moreover, considering that the descriptions of vulnerability reports and Web application are different but semantically similar, this paper uses semantic similarity to match the events of web application with the key information of the report, and then generates event sequences and corresponding test scripts to trigger the vulnerability, achieving vulnerability reproduction. To verify the effectiveness of our approach, we collect 400 vulnerability reports from more than 300 Web application projects and summarize syntactic dependency patterns. And 26 real vulnerability reports involving 23 open-source Web applications were used for experiments. The results show that our method can effectively extract critical information from vulnerability reports and generate feasible test scripts to reproduce vulnerabilities, reducing manual operations and improving the efficiency of vulnerability reproduction.