Detecting Taint-Style Vulnerabilities in Microservice-Structured Web Apps

MScan: Detecting Taint-Style Vulnerabilities in Microservice-Structured Web Applications

Speakers: Fengyu Liu, PhD Student, Fudan University; Yukun Xu, Postdoctoral Researcher, Hong Kong Polytechnic University

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=DhJphVrsof4

Reading Time: ~6 minutes

Type: Briefing

TL;DR

Fengyu Liu and Yukun Xu of Fudan University and Hong Kong Polytechnic University present MScan, a taint analysis framework that tracks vulnerability data flows across service boundaries in microservice architectures — a capability that tools like CodeQL fundamentally lack. Tested against 25 open-source and 5 industrial microservice applications, MScan found 59 previously unknown zero-day vulnerabilities with 72% precision, versus CodeQL's 23 findings at under 40% precision on the same targets.

Introduction

The shift from monolithic web applications to microservice architectures has changed how web systems are built and how they break. Where a monolith concentrates all logic in a single deployable unit, microservices distribute functionality across dozens or hundreds of independently deployed services communicating via REST APIs, gRPC, message queues (Kafka), and WebSockets. Each service can be developed, deployed, and scaled independently — a major operational advantage.

But from a security standpoint, this architecture creates a new class of vulnerability that existing detection tools are poorly equipped to find. A taint-style vulnerability — where untrusted user input reaches a dangerous operation like eval, arbitrary file write, or a database query without sanitization — can now span multiple services, with each individual service appearing clean in isolation while the cross-service data flow is exploitable. Fengyu Liu, a PhD student at Fudan University and core member of the CTF team Wizard (ranked #1 in 2025), and Yukun Xu, a postdoctoral researcher at Hong Kong Polytechnic University and Wizard co-founder, came to Black Hat 2025 to present MScan, a framework purpose-built to detect these inter-service vulnerabilities.

The Attack Surface: Intra-Service vs. Inter-Service Vulnerabilities

▶ Watch: Microservice Attack Surface Overview (02:00)

Microservice vulnerability classes split into two categories:

Intra-service vulnerabilities occur entirely within a single service — user input flows to a dangerous function like eval without validation, within one codebase. These are detectable by existing tools and represent the classic taint analysis problem.

Inter-service vulnerabilities are the hard problem. Here, tainted data enters through one service, passes through intermediate services via REST calls, Kafka messages, or gRPC, and only reaches the dangerous sink in a completely separate service. Each service, analyzed in isolation, may look secure. The vulnerability only exists in the cross-service data flow as a whole.

The real-world case study that motivates the research: a vulnerability in Spring Cloud Flow, a popular platform for building data pipelines under the Spring ecosystem. User input enters through a stream service, is passed without sanitization to another service via a RestTemplate call, and eventually reaches a files.write sink in a third service. No individual service analysis would flag this — the exploit path only becomes visible when the full inter-service data flow is modeled.

Why Existing Tools Fail: Three Core Challenges

▶ Watch: Detection Challenges (04:00)

Liu identifies three structural challenges that make microservice taint analysis hard for tools like CodeQL:

Challenge 1: Gateway-aware entry point identification. In a microservice system, an API gateway sits in front of all services and controls which endpoints are reachable by external users. An endpoint may exist in code but be blocked at the gateway — making it a non-entry point from an attacker's perspective. Gateway routing rules are complex, frequently changing, and almost never captured in static code analysis. Tools that ignore the gateway either flag unreachable endpoints (false positives) or miss reachable ones (false negatives).

Challenge 2: Cross-service data flow tracking. Services communicate using heterogeneous protocols — REST, gRPC, Kafka, WebSocket, custom protocols. Each has different conventions for how data is named, serialized, and routed. Traditional static analysis tools operate within a single codebase and have no mechanism to model how data crosses these inter-service boundaries.

Challenge 3: Scalability under long call chains. Microservice call chains are long. User input may traverse many services and many function call layers before reaching a dangerous operation. Full context-sensitive taint analysis — tracking not just which function is called but the specific call chain that reaches it — becomes computationally intractable at this scale, causing tools to time out or exhaust memory before completing analysis.

MScan's Architecture: Three Core Components

▶ Watch: MScan Design (06:00)

MScan addresses each challenge with a dedicated component:

1. LLM-based entry point identification. Rather than attempting to parse complex gateway configurations algorithmically, MScan uses a large language model with a few-shot prompting approach. The LLM is shown examples of gateway configurations and their corresponding accessible endpoints, then applied to new configurations. This significantly reduces false positives (flagging blocked endpoints) and false negatives (missing accessible ones) compared to purely pattern-based approaches.

2. Service Dependence Graph (SDG). MScan builds a unified graph that models how data flows between all services. To handle the diversity of inter-service communication protocols, MScan uses a plugin architecture: each communication method (REST via RestTemplate, gRPC, Kafka, OpenFeign, WebSocket) is handled by a dedicated plugin that can be updated or extended independently. Plugins identify sending and receiving endpoints and match them using identifiers — Kafka topic names, REST URIs — to stitch individual service graphs into one unified SDG.

3. Distance-guided context-sensitive analysis. MScan addresses the scalability problem with a dynamic strategy that adjusts context sensitivity based on proximity to a dangerous sink within the SDG. When a data path is far from any sink, MScan uses context-insensitive (coarser, cheaper) analysis. As data flows closer to a sink, context sensitivity increases, giving precise tracking precisely where it matters most. This reduces memory usage and analysis time for distant code while maintaining accuracy near dangerous operations.

Evaluation Results: 59 Zero-Days, 72% Precision

▶ Watch: Evaluation and Comparison with CodeQL (14:00)

MScan was evaluated against a dataset of 25 popular open-source microservice applications (each with over 1,000 GitHub stars) and 5 large-scale industrial applications from Alibaba Group, chosen for their real-world complexity.

MScan results: 59 previously unknown zero-day vulnerabilities detected, 72% precision (the proportion of reported issues that were confirmed real vulnerabilities).

CodeQL results on the same targets: 23 vulnerabilities found, under 40% precision. CodeQL missed 36 issues that MScan detected — a direct consequence of its inability to track data across service boundaries and its reliance on naive gateway configuration handling that flagged unreachable endpoints.

An ablation study confirmed that all three MScan components are essential:

• Disabling the SDG caused MScan to completely miss all inter-service vulnerabilities.
• Disabling distance-guided analysis caused the tool to run out of memory on large applications.
• Disabling LLM-based entry point identification degraded precision, flooding results with findings tied to inaccessible endpoints.

Three concrete case studies validated the approach:

• Microservices-Demo (open source): A SQL injection path where user input entered through a portal service, was passed via gRPC to an account service, and eventually reached a database query in a device event service. Traditional tools could not follow the gRPC handoff.

• Yunao Cloud: An exposed file upload endpoint in a file REST portal passed unsafe data through OpenFeign to a file REST service, where FileUtil.readBytes accepted the unfiltered input, enabling arbitrary file writes across services.

• Mogu Blog: A user-provided URL entered through a WeChat REST portal, passed via OpenFeign to a picture REST service, and reached a URL constructor without validation — a server-side request forgery risk. MScan's context-sensitive analysis correctly identified the cross-service path.

Notable Quotes

"Individually, each service might look secure, but together they create a vulnerability that isn't obvious when looking at just one service."

— Fengyu Liu ▶ 02:00

"Without SDG modeling, MScan completely missed the vulnerabilities that cross service boundaries. Turning off our distance-guided strategy often caused the analysis to run out of memory."

— Fengyu Liu ▶ 16:00

"CodeQL flagged endpoints that weren't even accessible to users. It also had quite a few false negatives because it cannot track data across services."

— Fengyu Liu ▶ 16:00

Key Takeaways

• Inter-service taint vulnerabilities are a blind spot for all single-service analysis tools, including CodeQL. Microservice architectures require a fundamentally different approach.
• Gateway-awareness is a prerequisite for accurate entry point identification. Ignoring routing rules produces both false positives (unreachable endpoints) and false negatives (reachable endpoints missed due to complex rules).
• A unified Service Dependence Graph across all communication protocols is necessary to track tainted data from its entry point to its eventual dangerous sink.
• Distance-guided context sensitivity provides a practical solution to the scalability problem inherent in full context-sensitive analysis of long microservice call chains.
• MScan found 59 zero-days vs. CodeQL's 23, at 72% precision vs. under 40%. The performance gap directly measures the cost of ignoring inter-service data flows in modern web application security analysis.

Slides: No slide PDF was available for this talk.