Why Microservice Architecture Spreads Security Risk

▶ Watch (01:10)

Most large web applications no longer run as a single unit. They split into small independent services that communicate over REST APIs, gRPC, and message queues like Kafka. Each service handles one job and can be deployed separately, which is efficient. It also means sensitive data moves across many boundaries.

The security consequence is direct: one weak service exposes every service downstream from it. A gateway sits at the front and routes user traffic to internal services based on routing rules, but those rules can change and can hide risks behind the appearance of access control.

Three Detection Challenges Standard Tools Cannot Handle

▶ Watch (05:02)

Three problems stop existing tools from finding cross-service bugs. Gateway routing rules determine which APIs users can actually reach, but CodeQL treats every API as public, generating false positives for blocked endpoints and missing real ones. Taint data moves via REST, gRPC, and Kafka; single-service analysis cannot follow those handoffs. And microservice call chains grow long enough that full context-sensitive analysis runs out of memory.

Spring Cloud Data Flow shows the pattern: user input entered one service, passed via REST template to a second, and reached a file write sink unsanitized. No single-service tool catches it.

LLM-Guided Entry Point Identification

▶ Watch (07:37)

MScan uses few-shot prompting to read gateway configuration files and identify which API endpoints users can actually reach. The LLM sees several examples of gateway rules paired with the real entries they expose, then applies that pattern to the target system. It skips any endpoint the gateway blocks. The matched results map directly to API methods in the source code, so taint analysis starts only from genuinely reachable sources. This step cuts false positives before the heavier analysis begins.

Service Dependence Graph and Distance-Guided Taint Analysis

▶ Watch (08:38)

MScan builds a service dependence graph by finding every API services use to communicate, across REST, gRPC, message queues, and WebSockets. A plugin system handles each type, so adding support for a new protocol does not require rebuilding the core. Topic names and URIs link sending and receiving services into one graph, making end-to-end taint tracking possible.

Full context-sensitive analysis on that graph exhausts memory. MScan’s distance-guided strategy scales context sensitivity to proximity: high precision near a sensitive sink, looser bounds further away. This keeps the analysis from running out of memory on long call chains.

Evaluation: 59 Zero-Days and the CodeQL Comparison

▶ Watch (14:20)

Tested on 25 open-source microservice applications plus five Alibaba production systems, MScan found 59 zero-day vulnerabilities at 72% precision. CodeQL, on the same targets, found 23 at under 40%. The gap came from CodeQL’s inability to read gateway configurations, track taint across services, and handle long call chains without timing out.

An ablation study confirmed every component matters: removing the service dependence graph missed all cross-service bugs; disabling the distance-guided strategy caused memory exhaustion. Cases included the IoT platform SQL injection case study (17:42) and the Mou Blog SSRF case study (19:26).

Key Takeaways

  • Taint-style bugs that cross service boundaries are invisible to single-service static analysis tools like CodeQL.
  • MScan’s three-component design found 59 zero-days at 72% precision across 30 real microservice applications.
  • Distance-guided context sensitivity keeps taint analysis from running out of memory on long microservice call chains.