QueryPie gRPC Security: ZAP Script Application Case

QueryPie has adopted the gRPC communication method for high performance and stability. gRPC, based on HTTP/2, is an efficient communication protocol that uses protocol buffers to transmit data in a fast and lightweight format, optimizing network resources. It supports bidirectional streaming between client and server for real-time data processing and offers excellent compatibility with various languages and platforms. This whitepaper examines the key issues encountered during vulnerability scanning of web applications implemented with gRPC and proposes solutions.

Why is gRPC Vulnerability Scanning Challenging?

Unlike the text-based HTTP/1.1, the binary format of HTTP/2 makes it difficult to read or modify requests and responses with typical proxy tools (e.g., Burp Suite, ZAP). gRPC uses Protocol Buffers (Protobuf) for data serialization, which, unlike JSON or XML, is a binary format and more difficult to analyze.

For example, when examining a packet from a web application implemented with gRPC, the POST request data may appear to simply be the string "cat" encoded in Base64 at first glance.

However, if the string "cat" is re-encoded in Base64, it becomes clear that the resulting POST data differs from the original. The server also fails to process the request correctly.

gRPC data requires analyzing the message structure through the .proto file and performing additional encoding/decoding tasks. However, most proxy and DAST tools either do not natively support gRPC encoding/decoding or offer limited support. Furthermore, manually repeating these tasks during vulnerability scanning is time-consuming. To address this issue, it’s essential to automate the gRPC encoding/decoding process and vulnerability identification during DAST scans to improve productivity.

Efficient gRPC Vulnerability Scanning Using ZAP

ZAP is a widely used proxy and DAST (Dynamic Application Security Testing) tool for web application vulnerability scanning. Its custom script feature allows for running local files or performing other tasks during automated scans. This enables the decoding of gRPC POST request data, insertion of attack payloads, and re-encoding for transmission. Additionally, decoding and analyzing gRPC server responses can automate the vulnerability detection process.

ZAP’s custom scripts support three different engines, and the ECMAScript (Graal.js) engine, in particular, provides flexibility in coding, offering testers a high degree of freedom. It allows testers to write code and execute shell commands locally, enabling a wide range of tasks.