Control-Flow integrity in web applications

Authors:
Bastian Braun;Patrick Gemein;Hans P. Reiser;Joachim Posegga
Affiliations:
Institute of IT-Security and Security Law (ISL), University of Passau, Germany;Institute of IT-Security and Security Law (ISL), University of Passau, Germany;Institute of IT-Security and Security Law (ISL), University of Passau, Germany;Institute of IT-Security and Security Law (ISL), University of Passau, Germany
Venue:
ESSoS'13 Proceedings of the 5th international conference on Engineering Secure Software and Systems
Year:
2013

Citing 11
Cited 0

Multi-module vulnerability analysis of web-based applications

Proceedings of the 14th ACM conference on Computer and communications security
On Race Vulnerabilities in Web Applications

DIMVA '08 Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Using static analysis for Ajax intrusion detection

Proceedings of the 18th international conference on World wide web
Ripley: automatically securing web 2.0 applications through replicated execution

Proceedings of the 16th ACM conference on Computer and communications security
Swaddler: an approach for the anomaly-based detection of state violations in web applications

RAID'07 Proceedings of the 10th international conference on Recent advances in intrusion detection
Eliminating navigation errors in web applications via model checking and runtime enforcement of navigation state machines

Proceedings of the IEEE/ACM international conference on Automated software engineering
NoTamper: automatic blackbox detection of parameter tampering opportunities in web applications

Proceedings of the 17th ACM conference on Computer and communications security
Enforcing request integrity in web applications

DBSec'10 Proceedings of the 24th annual IFIP WG 11.3 working conference on Data and applications security and privacy
Toward automated detection of logic vulnerabilities in web applications

USENIX Security'10 Proceedings of the 19th USENIX conference on Security
How to Shop for Free Online -- Security Analysis of Cashier-as-a-Service Based Web Stores

SP '11 Proceedings of the 2011 IEEE Symposium on Security and Privacy
BLOCK: a black-box approach for detection of state violation attacks towards web applications

Proceedings of the 27th Annual Computer Security Applications Conference

Quantified Score

Hi-index	0.00

Visualization

Abstract

Modern web applications frequently implement complex control flows, which require the users to perform actions in a given order. Users interact with a web application by sending HTTP requests with parameters and in response receive web pages with hyperlinks that indicate the expected next actions. If a web application takes for granted that the user sends only those expected requests and parameters, malicious users can exploit this assumption by crafting harming requests. We analyze recent attacks on web applications with respect to user-defined requests and identify their root cause in the missing explicit control-flow definition and enforcement. Based on this result, we provide our approach, a control-flow monitor that is applicable to legacy as well as newly developed web applications. It expects a control-flow definition as input and provides guarantees to the web application concerning the sequence of incoming requests and carried parameters. It protects the web application against race condition exploits, a special case of control-flow integrity violation. Moreover, the control-flow monitor supports modern browser features like multi-tabbing and back button usage. We evaluate our approach and show that it induces a negligible overhead.