Fear the EAR

Discovering and mitigating execution after redirect vulnerabilities

Adam Doupe, Bryce Boe, Christopher Kruegel, Giovanni Vigna

Research output: Chapter in Book/Report/Conference proceedingConference contribution

25 Citations (Scopus)

Abstract

The complexity of modern web applications makes it difficult for developers to fully understand the security implications of their code. Attackers exploit the resulting security vulnerabilities to gain unauthorized access to the web application environment. Previous research into web application vulnerabilities has mostly focused on input validation flaws, such as cross-site scripting and SQL injection, while logic flaws have received comparably less attention. In this paper, we present a comprehensive study of a relatively unknown logic flaw in web applications, which we call Execution After Redirect, or EAR. A web application developer can introduce an EAR by calling a redirect method under the assumption that execution will halt. A vulnerability occurs when server-side execution continues after the developer's intended halting point, which can lead to broken/insufficient access controls and information leakage. We start with an analysis of how susceptible applications written in nine web frameworks are to EAR vulnerabilities. We then discuss the results from the EAR challenge contained within the 2010 International Capture the Flag Competition. Finally, we present an open-source, white-box, static analysis tool to detect EARs in Ruby on Rails web applications. This tool found 3,944 EAR instances in 18,127 open-source applications. Finally, we describe an approach to prevent EARs in web frameworks.

Original languageEnglish (US)
Title of host publicationProceedings of the ACM Conference on Computer and Communications Security
Pages251-261
Number of pages11
DOIs
StatePublished - 2011
Externally publishedYes
Event18th ACM Conference on Computer and Communications Security, CCS'11 - Chicago, IL, United States
Duration: Oct 17 2011Oct 21 2011

Other

Other18th ACM Conference on Computer and Communications Security, CCS'11
CountryUnited States
CityChicago, IL
Period10/17/1110/21/11

Fingerprint

Defects
Ruby
Static analysis
Access control
Rails
Servers

Keywords

  • Execution after redirect
  • Static analysis
  • Web applications

ASJC Scopus subject areas

  • Software
  • Computer Networks and Communications

Cite this

Doupe, A., Boe, B., Kruegel, C., & Vigna, G. (2011). Fear the EAR: Discovering and mitigating execution after redirect vulnerabilities. In Proceedings of the ACM Conference on Computer and Communications Security (pp. 251-261) https://doi.org/10.1145/2046707.2046736

Fear the EAR : Discovering and mitigating execution after redirect vulnerabilities. / Doupe, Adam; Boe, Bryce; Kruegel, Christopher; Vigna, Giovanni.

Proceedings of the ACM Conference on Computer and Communications Security. 2011. p. 251-261.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Doupe, A, Boe, B, Kruegel, C & Vigna, G 2011, Fear the EAR: Discovering and mitigating execution after redirect vulnerabilities. in Proceedings of the ACM Conference on Computer and Communications Security. pp. 251-261, 18th ACM Conference on Computer and Communications Security, CCS'11, Chicago, IL, United States, 10/17/11. https://doi.org/10.1145/2046707.2046736
Doupe A, Boe B, Kruegel C, Vigna G. Fear the EAR: Discovering and mitigating execution after redirect vulnerabilities. In Proceedings of the ACM Conference on Computer and Communications Security. 2011. p. 251-261 https://doi.org/10.1145/2046707.2046736
Doupe, Adam ; Boe, Bryce ; Kruegel, Christopher ; Vigna, Giovanni. / Fear the EAR : Discovering and mitigating execution after redirect vulnerabilities. Proceedings of the ACM Conference on Computer and Communications Security. 2011. pp. 251-261
@inproceedings{4ebf03a4ad5b42ef8ddd11090fee7ce9,
title = "Fear the EAR: Discovering and mitigating execution after redirect vulnerabilities",
abstract = "The complexity of modern web applications makes it difficult for developers to fully understand the security implications of their code. Attackers exploit the resulting security vulnerabilities to gain unauthorized access to the web application environment. Previous research into web application vulnerabilities has mostly focused on input validation flaws, such as cross-site scripting and SQL injection, while logic flaws have received comparably less attention. In this paper, we present a comprehensive study of a relatively unknown logic flaw in web applications, which we call Execution After Redirect, or EAR. A web application developer can introduce an EAR by calling a redirect method under the assumption that execution will halt. A vulnerability occurs when server-side execution continues after the developer's intended halting point, which can lead to broken/insufficient access controls and information leakage. We start with an analysis of how susceptible applications written in nine web frameworks are to EAR vulnerabilities. We then discuss the results from the EAR challenge contained within the 2010 International Capture the Flag Competition. Finally, we present an open-source, white-box, static analysis tool to detect EARs in Ruby on Rails web applications. This tool found 3,944 EAR instances in 18,127 open-source applications. Finally, we describe an approach to prevent EARs in web frameworks.",
keywords = "Execution after redirect, Static analysis, Web applications",
author = "Adam Doupe and Bryce Boe and Christopher Kruegel and Giovanni Vigna",
year = "2011",
doi = "10.1145/2046707.2046736",
language = "English (US)",
isbn = "9781450310758",
pages = "251--261",
booktitle = "Proceedings of the ACM Conference on Computer and Communications Security",

}

TY - GEN

T1 - Fear the EAR

T2 - Discovering and mitigating execution after redirect vulnerabilities

AU - Doupe, Adam

AU - Boe, Bryce

AU - Kruegel, Christopher

AU - Vigna, Giovanni

PY - 2011

Y1 - 2011

N2 - The complexity of modern web applications makes it difficult for developers to fully understand the security implications of their code. Attackers exploit the resulting security vulnerabilities to gain unauthorized access to the web application environment. Previous research into web application vulnerabilities has mostly focused on input validation flaws, such as cross-site scripting and SQL injection, while logic flaws have received comparably less attention. In this paper, we present a comprehensive study of a relatively unknown logic flaw in web applications, which we call Execution After Redirect, or EAR. A web application developer can introduce an EAR by calling a redirect method under the assumption that execution will halt. A vulnerability occurs when server-side execution continues after the developer's intended halting point, which can lead to broken/insufficient access controls and information leakage. We start with an analysis of how susceptible applications written in nine web frameworks are to EAR vulnerabilities. We then discuss the results from the EAR challenge contained within the 2010 International Capture the Flag Competition. Finally, we present an open-source, white-box, static analysis tool to detect EARs in Ruby on Rails web applications. This tool found 3,944 EAR instances in 18,127 open-source applications. Finally, we describe an approach to prevent EARs in web frameworks.

AB - The complexity of modern web applications makes it difficult for developers to fully understand the security implications of their code. Attackers exploit the resulting security vulnerabilities to gain unauthorized access to the web application environment. Previous research into web application vulnerabilities has mostly focused on input validation flaws, such as cross-site scripting and SQL injection, while logic flaws have received comparably less attention. In this paper, we present a comprehensive study of a relatively unknown logic flaw in web applications, which we call Execution After Redirect, or EAR. A web application developer can introduce an EAR by calling a redirect method under the assumption that execution will halt. A vulnerability occurs when server-side execution continues after the developer's intended halting point, which can lead to broken/insufficient access controls and information leakage. We start with an analysis of how susceptible applications written in nine web frameworks are to EAR vulnerabilities. We then discuss the results from the EAR challenge contained within the 2010 International Capture the Flag Competition. Finally, we present an open-source, white-box, static analysis tool to detect EARs in Ruby on Rails web applications. This tool found 3,944 EAR instances in 18,127 open-source applications. Finally, we describe an approach to prevent EARs in web frameworks.

KW - Execution after redirect

KW - Static analysis

KW - Web applications

UR - http://www.scopus.com/inward/record.url?scp=80755187811&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=80755187811&partnerID=8YFLogxK

U2 - 10.1145/2046707.2046736

DO - 10.1145/2046707.2046736

M3 - Conference contribution

SN - 9781450310758

SP - 251

EP - 261

BT - Proceedings of the ACM Conference on Computer and Communications Security

ER -