TY - GEN
T1 - Fear the EAR
T2 - 18th ACM Conference on Computer and Communications Security, CCS'11
AU - Doupé, Adam
AU - Boe, Bryce
AU - Kruegel, Christopher
AU - Vigna, Giovanni
PY - 2011/11/14
Y1 - 2011/11/14
N2 - The complexity of modern web applications makes it difficult for developers to fully understand the security implications of their code. Attackers exploit the resulting security vulnerabilities to gain unauthorized access to the web application environment. Previous research into web application vulnerabilities has mostly focused on input validation flaws, such as cross-site scripting and SQL injection, while logic flaws have received comparably less attention. In this paper, we present a comprehensive study of a relatively unknown logic flaw in web applications, which we call Execution After Redirect, or EAR. A web application developer can introduce an EAR by calling a redirect method under the assumption that execution will halt. A vulnerability occurs when server-side execution continues after the developer's intended halting point, which can lead to broken/insufficient access controls and information leakage. We start with an analysis of how susceptible applications written in nine web frameworks are to EAR vulnerabilities. We then discuss the results from the EAR challenge contained within the 2010 International Capture the Flag Competition. Finally, we present an open-source, white-box, static analysis tool to detect EARs in Ruby on Rails web applications. This tool found 3,944 EAR instances in 18,127 open-source applications. Finally, we describe an approach to prevent EARs in web frameworks.
AB - The complexity of modern web applications makes it difficult for developers to fully understand the security implications of their code. Attackers exploit the resulting security vulnerabilities to gain unauthorized access to the web application environment. Previous research into web application vulnerabilities has mostly focused on input validation flaws, such as cross-site scripting and SQL injection, while logic flaws have received comparably less attention. In this paper, we present a comprehensive study of a relatively unknown logic flaw in web applications, which we call Execution After Redirect, or EAR. A web application developer can introduce an EAR by calling a redirect method under the assumption that execution will halt. A vulnerability occurs when server-side execution continues after the developer's intended halting point, which can lead to broken/insufficient access controls and information leakage. We start with an analysis of how susceptible applications written in nine web frameworks are to EAR vulnerabilities. We then discuss the results from the EAR challenge contained within the 2010 International Capture the Flag Competition. Finally, we present an open-source, white-box, static analysis tool to detect EARs in Ruby on Rails web applications. This tool found 3,944 EAR instances in 18,127 open-source applications. Finally, we describe an approach to prevent EARs in web frameworks.
KW - Execution after redirect
KW - Static analysis
KW - Web applications
UR - http://www.scopus.com/inward/record.url?scp=80755187811&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=80755187811&partnerID=8YFLogxK
U2 - 10.1145/2046707.2046736
DO - 10.1145/2046707.2046736
M3 - Conference contribution
AN - SCOPUS:80755187811
SN - 9781450310758
T3 - Proceedings of the ACM Conference on Computer and Communications Security
SP - 251
EP - 261
BT - CCS'11 - Proceedings of the 18th ACM Conference on Computer and Communications Security
Y2 - 17 October 2011 through 21 October 2011
ER -