Abstract:In software development, developers extensively utilize third-party libraries to avoid implementing existing functionalities. When a new third-party library vulnerability is disclosed, project maintainers need to determine whether their projects are affected by the vulnerability, which requires developers to invest substantial effort in assessment. However, existing tools face a series of issues: static analysis tools produce false alarms, dynamic analysis tools require existing tests and test generation tools have low success rates when facing complex vulnerabilities. Vulnerability exploits, as code snippets provided for reproducing vulnerabilities after disclosure, contain a wealth of vulnerability-related information. This study proposes a new method based on vulnerability exploits, called VESTA (Vulnerability Exploit-based Software Testing Auto-Generator), which provides vulnerability exploit tests as the basis for developers to decide whether to update dependencies. VESTA extends the search-based test generation methods by adding a migration step, ensuring the similarity between the generated test and the vulnerability exploit, which increases the likelihood of detecting potential library vulnerabilities in a project. We perform experiments on 30 vulnerabilities disclosed in the past five years, involving 60 vulnerability-project pairs, and compare the experimental results with the baseline method, TRANSFER. The success rate of VESTA is 71.7\% which is a 53.4\% improvement over TRANSFER in the effectiveness of verifying exploitable vulnerabilities.

A cross-platform multifunctional testbed for vulnerability attack

A Generic Testbed for Security Enhancement Tools

Vulnerability Detection For Smart Grid Devices Via Static Analysis

Detecting Buffer-Overflow Vulnerabilities in Smart Grid Devices via Automatic Static Analysis

A Comparison of Static Analysis Technology for Intrusion Prevention

How to build a vulnerability benchmark to overcome cyber security attacks

Vulnerability analysis dased on a fuzzy input testing

An Empirical Study on Benchmarks of Artificial Software Vulnerabilities

A systematic review of fuzzy testing for information systems and applications

Evaluating C/C++ Vulnerability Detectability of Query-Based Static Application Security Testing Tools

An Empirical Study on Detecting and Fixing Buffer Overflow Bugs

Benchmarking Software Vulnerability Detection Techniques: A Survey

Exploiting Library Vulnerability via Migration Based Automating Test Generation

Protocol vulnerability detection based on network traffic analysis and binary reverse engineering

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

Vulnerability Detection System Based on Taint Range Propagation Analysis

Network computer security hidden dangers and vulnerability mining technology

Vulnerability Testing of Desktop OS Based on Linux

Cross-level Monte Carlo Framework for System Vulnerability Evaluation Against Fault Attack

Open-source Defect Injection Benchmark Testbed for the Evaluation of Testing

Research for Buffer Overflow Vulnerabilities Based on Multi-Dimensional Fuzzing Technology