Fear the EAR: Discovering and mitigating execution after redirect vulnerabilities

Adam Doupé, Bryce Boe, Christopher Kruegel, Giovanni Vigna

Research output: Chapter in Book/Report/Conference proceedingConference contribution

29 Scopus citations

Abstract

The complexity of modern web applications makes it difficult for developers to fully understand the security implications of their code. Attackers exploit the resulting security vulnerabilities to gain unauthorized access to the web application environment. Previous research into web application vulnerabilities has mostly focused on input validation flaws, such as cross-site scripting and SQL injection, while logic flaws have received comparably less attention. In this paper, we present a comprehensive study of a relatively unknown logic flaw in web applications, which we call Execution After Redirect, or EAR. A web application developer can introduce an EAR by calling a redirect method under the assumption that execution will halt. A vulnerability occurs when server-side execution continues after the developer's intended halting point, which can lead to broken/insufficient access controls and information leakage. We start with an analysis of how susceptible applications written in nine web frameworks are to EAR vulnerabilities. We then discuss the results from the EAR challenge contained within the 2010 International Capture the Flag Competition. Finally, we present an open-source, white-box, static analysis tool to detect EARs in Ruby on Rails web applications. This tool found 3,944 EAR instances in 18,127 open-source applications. Finally, we describe an approach to prevent EARs in web frameworks.

Original languageEnglish (US)
Title of host publicationCCS'11 - Proceedings of the 18th ACM Conference on Computer and Communications Security
Pages251-261
Number of pages11
DOIs
StatePublished - Nov 14 2011
Externally publishedYes
Event18th ACM Conference on Computer and Communications Security, CCS'11 - Chicago, IL, United States
Duration: Oct 17 2011Oct 21 2011

Publication series

NameProceedings of the ACM Conference on Computer and Communications Security
ISSN (Print)1543-7221

Conference

Conference18th ACM Conference on Computer and Communications Security, CCS'11
CountryUnited States
CityChicago, IL
Period10/17/1110/21/11

Keywords

  • Execution after redirect
  • Static analysis
  • Web applications

ASJC Scopus subject areas

  • Software
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Fear the EAR: Discovering and mitigating execution after redirect vulnerabilities'. Together they form a unique fingerprint.

  • Cite this

    Doupé, A., Boe, B., Kruegel, C., & Vigna, G. (2011). Fear the EAR: Discovering and mitigating execution after redirect vulnerabilities. In CCS'11 - Proceedings of the 18th ACM Conference on Computer and Communications Security (pp. 251-261). (Proceedings of the ACM Conference on Computer and Communications Security). https://doi.org/10.1145/2046707.2046736