NDLI: Automated detection of client-state manipulation vulnerabilities

Content Provider	IEEE Xplore Digital Library
Author	Moller, A. Schwarz, M.
Copyright Year	2012
Description	Author affiliation: Department of Computer Science, Aarhus University (Moller, A.; Schwarz, M.)
Abstract	Web application programmers must be aware of a wide range of potential security risks. Although the most common pitfalls are well described and categorized in the literature, it remains a challenging task to ensure that all guidelines are followed. For this reason, it is desirable to construct automated tools that can assist the programmers in the application development process by detecting weaknesses. Many vulnerabilities are related to web application code that stores references to application state in the generated HTML documents to work around the statelessness of the HTTP protocol. In this paper, we show that such client-state manipulation vulnerabilities are amenable to tool supported detection. We present a static analysis for the widely used frameworks Java Servlets, JSP, and Struts. Given a web application archive as input, the analysis identifies occurrences of client state and infers the information flow between the client state and the shared application state on the server. This makes it possible to check how client-state manipulation performed by malicious users may affect the shared application state and cause leakage or modifications of sensitive information. The warnings produced by the tool help the application programmer identify vulnerabilities. Moreover, the inferred information can be applied to configure a security filter that automatically guards against attacks. Experiments on a collection of open source web applications indicate that the static analysis is able to effectively help the programmer prevent client-state manipulation vulnerabilities.
Starting Page	749
Ending Page	759
File Size	401250
Page Count	11
File Format	PDF
ISBN	9781467310666
ISSN	02705257
e-ISBN	9781467310673
e-ISBN	9781467310659
DOI	10.1109/ICSE.2012.6227143
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2012-06-02
Publisher Place	Switzerland
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	HTML Servers Security Electronic mail Java Libraries Safety static analysis Web application security information flow analysis
Content Type	Text
Resource Type	Article
Subject	Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Automated Detection of Client-State Manipulation Vulnerabilities

Automated detection of client-state manipulation vulnerabilities.

Errors in web applications are often critical. To protect web applic...

Enhancing Automated Detection of Vulnerabilities in Java Components

Static detection of cross-site scripting vulnerabilities

Identification of Malicious Web Pages with Static Heuristics

Automated detection of client-state manipulation vulnerabilities

A hybrid analysis framework for detecting web application vulnerabilities

Static Detection of Logic Vulnerabilities in Java Web Applications

Automated detection of client-state manipulation vulnerabilities

Similar Documents

Automated Detection of Client-State Manipulation Vulnerabilities

Automated detection of client-state manipulation vulnerabilities.

Errors in web applications are often critical. To protect web applic...

Enhancing Automated Detection of Vulnerabilities in Java Components

Static detection of cross-site scripting vulnerabilities

Identification of Malicious Web Pages with Static Heuristics

Automated detection of client-state manipulation vulnerabilities

A hybrid analysis framework for detecting web application vulnerabilities

Static Detection of Logic Vulnerabilities in Java Web Applications

Automated detection of client-state manipulation vulnerabilities