Automata-based symbolic string analysis for vulnerability detection

  • Authors:

  • Fang Yu;Muath Alkhalaf;Tevfik Bultan;Oscar H. Ibarra

  • Affiliations:

  • Department of Management Information Systems, National Chengchi University, Taipei, Taiwan;Department of Computer Science, University of California Santa Barbara, Santa Barbara, USA;Department of Computer Science, University of California Santa Barbara, Santa Barbara, USA;Department of Computer Science, University of California Santa Barbara, Santa Barbara, USA

  • Venue:
  • Formal Methods in System Design
  • Year:
  • 2014

Quantified Score

Hi-index 0.00

Visualization

Abstract

Verifying string manipulating programs is a crucial problem in computer security. String operations are used extensively within web applications to manipulate user input, and their erroneous use is the most common cause of security vulnerabilities in web applications. We present an automata-based approach for symbolic analysis of string manipulating programs. We use deterministic finite automata (DFAs) to represent possible values of string variables. Using forward reachability analysis we compute an over-approximation of all possible values that string variables can take at each program point. Intersecting these with a given attack pattern yields the potential attack strings if the program is vulnerable. Based on the presented techniques, we have implemented Stranger, an automata-based string analysis tool for detecting string-related security vulnerabilities in PHP applications. We evaluated Stranger on several open-source Web applications including one with 350,000+ lines of code. Stranger is able to detect known/unknown vulnerabilities, and, after inserting proper sanitization routines, prove the absence of vulnerabilities with respect to given attack patterns.