If you ask any Application Security Engineer or Sr. Product Security pro, they’ll tell you that the breaches, bounties, and attacks that cause the most damage are often the ones around authorization and access control. We get it, it’s a constant battle against evolving threats, and here at DryRun Security, we're building a tool that helps you stay ahead of the curve.
Today, I'm excited to announce the launch of two powerful new analyzers integrated into our platform: SSRF (Server-Side Request Forgery) and IDOR (Insecure Direct Object References). These new additions bolster our suite of analyzers, ensuring that we continue to provide security insights for modern development workflows.
The Value of DryRun Security
Before diving into the specifics of SSRF and IDOR, I want to tell you why DryRun Security is changing the game in application security. Traditional security tools often burden developers with a slew of false positives and lengthy feedback loops, leading to frustration and inefficiency. DryRun Security takes a different approach with Contextual Security Analysis (CSA).
Contextual Security Analysis, covered in depth in our Contextual Security Analysis Guide, uses a mixture of behavioral and anti/pattern analysis to make informed, real-time security assertions. By analyzing every change using the SLIDE framework (Surface, Lang, Intent, Detection, & Environment) and our proprietary Code Review Inquiry Methodology (CRIM) for LLMs , we’re able to identify the most risky commits very early in the development cycle. Often just seconds after they’re committed.
Comprehensive Analyzer Suite
Our platform's suite of analyzers forms the foundation of CSA, each targeting specific security concerns:
SQL Injection (SQLi) Analyzer: Detects SQL injection vulnerabilities for most of the major ORMs and languages/frameworks.
Secrets Analyzer: Identifies hardcoded secrets, like API keys or passwords, embedded in the code.
Authentication and Authorization (Authn/z) Analyzer: Identifies pull requests that are modifying authentication and authorization mechanisms which elevate any risks associated with the change.
Codepath Analyzer: Examines modified codepaths to either sensitive changes or modifications made by unauthorized contributors.
SSRF Analyzer: Newly launched, it detects SSRF vulnerabilities, preventing attackers from tricking the server into sending requests to unintended locations.
IDOR Analyzer: Also newly launched, it identifies insecure direct object references, preventing unauthorized access to sensitive data.
Understanding SSRF
Server-Side Request Forgery (SSRF) is a critical vulnerability where an attacker can trick the server into making requests to unintended destinations, potentially exposing internal systems and data. Consider the following code example:
```python
# PYTHON
import requests
def fetch_data(url):
response = requests.get(url)
return response.content
# User input is directly passed to the fetch_data function
user_url = request.GET.get(“url”)
data = fetch_data(user_url)
print(data)
```
In this example, if an attacker provides a malicious URL, they could trick the server into accessing internal systems or external services, leading to data breaches or other malicious activities. The SSRF Analyzer within DryRun Security detects such vulnerabilities by examining the context in which URLs are fetched and ensuring they are properly validated.
Importance of IDOR
Every single AppSec Engineer that’s using our service has told us that Insecure Direct Object References (IDOR), aka broken object level access, is a top issue for them and it’s caused them a lot of strain in their job role. IDOR allows attackers to access unauthorized data by manipulating references to objects within the application. This can lead to severe data breaches if not properly addressed. Here’s a simple code snippet illustrating an IDOR vulnerability:
```java
@RestController
public class UserProfileController {
@Autowired
private UserProfileService userProfileService;
@GetMapping("/users/{userId}")
public UserProfile getUserProfile(@PathVariable Long userId) {
return userProfileService.getUserProfile(userId);
}
}
```
In this example, if an attacker alters the `userId` parameter to another user's ID, they could gain unauthorized access to that user's information. The IDOR Analyzer identifies such risks by analyzing how object references are handled and ensuring appropriate access controls are enforced.
Why These Analyzers Matter
The addition of SSRF and IDOR analyzers to our suite significantly enhances our ability to detect more of the critical vulnerabilities organizations care about, including items on the OWASP Top Ten list. This also gives us a first step in honing our detection around access control and authorization. These analyzers integrate seamlessly into our CSA framework, providing context-aware security assessments that help developers secure their applications efficiently and effectively.
Try DryRun Security Yourself
At DryRun Security, we believe in empowering developers to build secure applications without compromising on productivity. Our approach to Contextual Security Analysis is designed to fit naturally within your development workflow, offering precise and actionable security insights with minimal disruption.
Ready to experience the power of Contextual Security Analysis for yourself? Request a demo or try our product today and see how our suite of analyzers, including our new SSRF and IDOR analyzers, can help you secure your code with confidence.
Explore more at DryRun Security and download our free Contextual Security Analysis Guide to learn more about our innovative approach to application security.
