• Abstract and Figures
• Public Full-text

Preventing Input Validation Vulnerabilities in Web Applications through Automated Type Analysis Theodoor Scholte William Robertson SAP Research, Sophia Antipolis, France Northeastern University, Boston, USA [email protected] [email protected] Davide Balzarotti Engin Kirda Institut Eurecom, Sophia Antipolis, France Northeastern University, Boston, USA [email protected] [email protected] Abstract—Web applications have become an integral part dangerous HTML elements, typically including malicious of the daily lives of millions of users. Unfortunately, web client-side code that executes in the security context of a applications are also frequently targeted by attackers, and trusted web origin. In the latter case, a SQL injection injec- criticial vulnerabilities such as XSS and SQL injection are still common. As a consequence, much effort in the past decade has tion vulnerability allows an attacker to modify an existing been spent on mitigating web application vulnerabilities. database query — or, in some cases, to inject a completely Current techniques focus mainly on sanitization: either on new one — in such a way that violates the web application’s automated sanitization, the detection of missing sanitizers, desired data integrity or confidentiality policies. the correctness of sanitizers, or the correct placement of One particularly promising approach to preventing the sanitizers. However, these techniques are either not able to prevent new forms of input validation vulnerabilities such as exploitation of these vulnerabilities is robust, automated HTTP Parameter Pollution, come with large runtime overhead, sanitization of untrusted input. In this approach, filters, lack precision, or require significant modifications to the client or sanitizers, are automatically applied to user data such and/or server infrastructure. that dangerous constructs cannot be injected into HTML In this paper, we present IPAAS, a novel technique for documents or SQL queries. Automated protection against preventing the exploitation of XSS and SQL injection vul- nerabilities based on automated data type detection of input these vulnerabilities is highly desirable due to the well- parameters. IPAAS automatically and transparently augments known difficulty in manually achieving complete and correct otherwise insecure web application development environments sanitizer coverage. with input validators that result in significant and tangible secu- Output sanitization: A particularly promising approach rity improvements for real systems. We implemented IPAAS for in this vein is automated output sanitization, where sanitizers PHP and evaluated it on five real-world web applications with known XSS and SQL injection vulnerabilities. Our evaluation are automatically applied to data computed from untrusted demonstrates that IPAAS would have prevented 83% of SQL data immediately prior to its use in document or query injection vulnerabilities and 65% of XSS vulnerabilities while construction [23], [27], [36]. Output sanitization that is incurring no developer burden. automated, context-aware, and robust with respect to real browsers and databases is an extremely attractive solution to I. INTRODUCTION preventing XSS and SQL injection attacks. This is because Web applications have become attractive targets for at- it provides a high degree of assurance that the protection tackers due to the large degree of authority they possess, system’s view of untrusted data used to compute documents their significant user populations, and the prevalence of and queries is identical to the real system’s view. That is, vulnerabilities they contain. Among the classes of vul- if an output sanitizer decides that a value computed from nerabilities exhibited by web applications, XSS and SQL untrusted data is safe, then it is almost certainly the case injection remain among the most serious threats to web that that data is actually safe to render to the user or submit application security. As such, much attention in the security to the database. research community has focused on removing or mitigating Unfortunately, output sanitization is not a panacea. In the effect of these vulnerabilities [2], [12], [18], [35]. particular, in order to achieve correctness and complete XSS and SQL injection vulnerabilities both manifest at coverage of all locations where untrusted data is used to a fundamental level as a failure to preserve the integrity build HTML documents and SQL queries, it is necessary to of HTML documents and SQL queries, respectively, in the construct an abstract representation of these objects in order presence of untrusted input to the web application. In the to track output contexts. This generally requires the direct former case, an XSS vulnerability allows an attacker to inject specification of documents and queries in a domain-specific language [23], [27], or else the use of a language amenable OWASP WebScarab extension to extract and learn parameter to precise static analysis. While new web applications have types, and a runtime PHP rewriting component to enforce the option of using a secure-by-construction development proper validation of parameter values. We evaluated our framework or templating language, legacy web applications system over five real-world PHP-based applications contain- do not have this luxury. Furthermore, many web developers ing numerous XSS and SQL injection vulnerabilities, and continue to use insecure languages and frameworks for new demonstrate that IPAAS would prevent 83% of known SQL applications. injection attacks and 65% of known XSS attacks against the Input validation: In contrast to output sanitization, set of test applications. another approach for preventing XSS and SQL injection Unfortunately, due to the inherent drawbacks of input injection vulnerabilities is the use of input validation. Input validation, IPAAS is not able to protect against all kind of validation involves checking the inputs to the web appli- XSS and SQL injection attacks. However, our experiments cation against a specification of legitimate values (e.g., a show that IPAAS is a simple and effective solution that certain parameter should be an integer, or an email address, can greatly improve the security of web applications. Our or a URL). Input validation is more general than output technique automatically and transparently applies input val- sanitization in the sense that input validation has the broader idators during the development phase of a web applications. goal of program correctness rather than preventing specific Therefore, IPAAS helps developers that are unaware of web classes of attacks. However, input validation provides less application security issues to write more secure applications. assurance that vulnerabilities will be prevented, since it Contributions: To summarize, in this work, we make relies on check routines to validate untrusted input, but it the following contributions. may still fail to identify the input as being malicious. In • We identify automated input validation as an effective addition to that, untrusted data can also undergo potentially alternative to output sanitization for preventing XSS arbitrary transformations, as part of application processing and SQL injection vulnerabilities in legacy applications, prior to being output into a document or query, making input or where developers choose to use insecure legacy validation ineffective. languages and frameworks. We note, however, that despite these drawbacks, input • We implement the IPAAS approach for transparently validation has significant benefits as well. First, even though learning types for web application parameters, and input validation is not necessarily focused on enforcing automatically applying robust validators for these pa- security constraints, rigorous application of robust input rameters at runtime. validators has been shown to be remarkably effective at • We evaluate our implementation for PHP, and demon- preventing XSS and SQL injection attacks in real, vulnerable strate its ability to prevent the exploitation of 65% of web applications [30], [31]. For instance, we have demon- XSS vulnerabilities and 83% of SQL injection vulnera- strated that robust input validation would have been able bilities with a low false positive rate over five real-world to prevent the majority of XSS and SQL injection attacks PHP applications. against a large corpus of known vulnerable web applications. The remainder of the paper is structured as follows. In xII, Second, it is comparatively simple to achieve complete we discuss our motivations for studying input validation as coverage of untrusted input to web applications as opposed a prevention mechanism for XSS and SQL injection vulner- to the case of output sanitization. Web application inputs abilities. xIII presents the IPAAS approach to automatically can be enumerated given a priori knowledge of the language applying robust input validation to web applications. xIV and development framework, whereas context-aware output evaluates our implementation of IPAAS for PHP over a test sanitization imposes strict language requirements that often set of vulnerable PHP applications. We present related work conflict with developer preferences. Consequently, input val- in xV. In xVI, we conclude and discuss potential future work. idation can be applied even when insecure legacy languages and frameworks are used. II. BACKGROUND IPAAS: In this work, we present IPAAS (Input Input validation and sanitization are related techniques for PArameter

Load more

  11

Copy Link