Event Handler Poisoning: Attacks and Defenses
Total Page：16
File Type：pdf, Size：1020Kb
Event Handler Poisoning: Attacks and Defenses Anonymous Anonymous [email protected] Abstract—The software development community has begun to are the first to examine the security implications of using the adopt the Event-Driven Architecture (EDA) to provide scalable EDA at a software architecture-level. In xIII we describe a web services. Though the Event-Driven Architecture can offer new Denial of Service attack that can be used against EDA- better scalability than the One Thread Per Client Architecture, based services. Our Event Handler Poisoning attack identifies its use exposes service providers to a Denial of Service attack the most important limited resource in the EDA: the Event that we call Event Handler Poisoning (EHP). With the rise in the Handlers themselves. use of the EDA may come a plague of EHP attacks threatening critical Internet services. The EDA’s scalability is also its Achilles’ heel. Multiplex- In this work we define EHP attacks, dividing them into ing unrelated work onto the same thread reduces overhead, two types, CPU-bound and I/O-bound. After examining EHP but it also moves the burden of time sharing out of the thread vulnerabilities in the popular Node.js EDA framework and open- library or operating system and into the application itself. source npm modules, we explore two representative EHP attacks Where OTPCA-based services can rely on the preemptive in detail: Regular Expression Denial of Service (ReDoS) and I/O- multitasking promised by the underlying system to ensure based Denial of Service (IODoS). that resources are shared fairly, using the EDA requires the Using our Constant Worst-Case Execution Time (C-WCET) service to enforce its own cooperative multitasking [48]. In Partitioning pattern, EDA-based services can become invulnera- other words, thread multiplexing destroys isolation. An EHP ble to EHP attacks. Guided by this pattern, we present Node.cure, attack identifies a way to defeat the cooperative multitasking which defends Node.js applications against both ReDoS and IO- used by an EDA-based service, ensuring Event Handler(s) DoS. Our evaluation shows Node.cure to be effective. In assessing remain dedicated to the attacker rather than handling all clients ReDoS, we extracted a novel corpus of 27,808 regular expressions fairly. We motivate this problem by identifying both CPU- from Node.js modules. Among these, Node.cure renders 51% of bound and I/O-bound EHP attacks among previously-reported 4122 possible ReDoS vulnerabilities harmless without requiring application refactoring, including 96% of the 55 known ReDoS Node.js vulnerabilities (xIII). vulnerabilities. Meanwhile, Node.cure can detect and defeat File In xIV we present the C-WCET partitioning programming IODoS with a modest overhead. pattern, a general principle that EDA-based services can use to prevent EHP attacks. Because EHP attacks are possible when I. INTRODUCTION one request to an EDA-based server doesn’t cooperatively yield Web services are the lifeblood of the modern Internet. To to other requests, our pattern is simple: every stage of request handle the demands of millions of clients, service providers handling can take no more than constant time before it yields replicate their services across many servers. Since every server to other requests. In applying this principle, EDA-based servers costs time and money, service providers want to maximize the extend input sanitization from the realm of data into the realm number of clients each server can handle. Over the past decade, of the algorithms used to process it. this goal has led the software community to seriously consider We evaluate the popular EDA-based Node.js ecosystem in a paradigm shift in their software architecture — from the One light of this principle. We first report that the community at Thread Per Client Architecture (OTPCA) used in Apache to 1 large does not seem to be aware of the problem (xV). We the Event-Driven Architecture (EDA) championed by Node.js . then identify both framework-level and application-level EHP We report that although using the EDA may increase the vulnerabilities in the Node.js ecosystem. In case studies for Re- number of clients each server can handle, it also exposes the DoS (xVI) and IODoS (xVII), our Node.cure prototype applies service to a new class of Denial of Service (DoS) attack unique our C-WCET partitioning pattern to address the framework- to the EDA: Event Handler Poisoning (EHP). level vulnerabilities we identified. The OTPCA and the EDA differ in the resources they 2 dedicate to each client. In the OTPCA, each client is assigned This paper is an extension of a workshop paper . There a thread, and the overhead associated with each thread limits we introduced the idea of EHP attacks, argued that some the number of concurrent clients the service can handle. In previously-reported security vulnerabilities were actually EHP the EDA, a small pool of Event Handler threads is shared vulnerabilities, and gave a sketch of our antidote. Here we offer by all clients, and the application is structured to let each the complete package: a refined definition of EHP, examples of Event Handler accommodate multiple clients. The per-client vulnerabilities in the wild, a general principle for defense, and overhead is thus smaller in the EDA, improving scalability. effective framework-level defenses. Only in xV do we draw largely from our previously-published material. Though researchers have investigated application- and language-level security issues that affect many services, we In summary, this paper makes the following contributions: 1The EDA paradigm is also known as the reactor pattern. 2We omit the reference to meet the double-blind requirement. 1) We are the first to define Event Handler Poisoning (EHP) (xIII), a DoS attack against the EDA. EHP attacks consume Event Handlers, a limited resource in the EDA. Our defini- tion of EHP is general enough to accommodate all known EHP attacks. 2) We describe a general antidote for Event Handler Poison- ing: C-WCET partitioning (xIV). Our C-WCET partitioning pattern gives developers precise guidance for defending against EHP attacks, replacing the heuristics used by the EDA community. 3) We perform case studies on two EHP vulnerabilities in the popular Node.js framework, showing the practicality of our C-WCET antidote even when applied to complex problems like ReDoS (xVI) and IODoS (xVII). In xVI we also extend Fig. 1. This is the AMPED Event-Driven Architecture. Incoming events are the state of the art on ReDoS vulnerability detection. stored on the event queue to be handled sequentially by the Event Loop. The Event Loop may generate new events, to be handled by itself later or as Tasks offloaded to the Worker Pool. Alas, B has performed an EHP attack on this II. BACKGROUND service. His evil input (third in the event queue) will poison the Event Loop, and the events after his input will not be handled. In this section we contrast the EDA with the OTPCA (xII-A). We then explain our choice of EDA framework for (e.g. through Linux’s poll system call4), and pending events study (xII-B), and finish by introducing formative work on are handled sequentially by an Event Loop. The Event Loop Algorithmic Complexity attacks (xII-C). may offload expensive Tasks as events to a small, fixed-size Worker Pool, which generates a new event for the Event Loop A. Overview of the EDA when each Task is finished. We refer to the Event Loop and the Workers in the Worker Pool as Event Handlers because There are two main architectures for scalable web servers, only they can handle events. The Worker Pool is implemented the established One Thread Per Client Architecture (OTPCA) using threads or separate processes. One common use of the and the upstart Event-Driven Architecture (EDA). In the OT- Worker Pool is to provide quasi-asynchronous (blocking but 3 PCA style, exemplified by the Apache Web Server , each client concurrent) access to the file system. is assigned a thread or a process, with a large maximum number of concurrent clients. The OTPCA model isolates Application developers must adopt the EDA paradigm clients from one another, reducing the risk of interference. when developing EDA-based software. Developers must define However, each additional client incurs memory and context the set of possible Events for which they supply a set of Call- switching overhead. In contrast, by multiplexing multiple client backs [24]. During the execution of an EDA-based application, connections into a single thread and offering a small Worker events are generated by external activity or internal processing Pool for asynchronous tasks, the EDA approach reduces a and routed to the appropriate Callbacks. Each Callback is server’s per-client resource use. While the OTPCA and EDA executed by one of the Event Handlers, either by the Event architectures have the same expressive power [32], in practice Loop for synchronous operations or by a Worker from the EDA-based servers can offer greater scaling [44]. Worker Pool for asynchronous operations. Because there are Although EDA approaches have been discussed and im- relatively few Event Handlers, cooperative multitasking is a plemented in the academic and professional communities for must; developers partition the generation of responses into decades (e.g. [54], [5], [26], [20], [57], [46]), historically the multiple stages (event chains) and regularly yield to other EDA has only seen wide adoption in user interface settings like requests [16]. Unfortunately, in Figure 1 an attacker B carried GUIs and web browsers. How things have changed. The EDA out an EHP attack, defeating the cooperating multitasking and is increasingly relevant in systems programming today thanks preventing other requests from being handled. largely to the explosion of interest in Node.js, an event-driven server-side JavaScript framework.