Static Detection of Second-Order Vulnerabilities in Web Applications - PowerPoint PPT Presentation

Static Detection of Second-Order Vulnerabilities in Web Applications Johannes Dahse and Thorsten Holz Ruhr-University Bochum USENIX Security ’14, 20-22 August 2014, San Diego, CA, USA

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion „First-Order“ Vulnerabilities ● SQL injection <?php $name = $_POST ['name']; // ', 1), (version(), 1)-- - $sql = “INSERT INTO users VALUES (' $name ', '$pwd')“; mysql_query ( $sql ); ?> send !“*$()&/'\ user input application 2

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Sanitization ● SQL injection (prevented) <?php $name = mysql_real_escape_string ( $_POST ['name']); $sql = “INSERT INTO users VALUES (' $name ', '$pwd')“; mysql_query ( $sql ); ?> send !“*$()&/'\ user input application 3

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Vulnerability (1) ● Database Write <?php $name = mysql_real_escape_string ( $_POST ['name']); $sql = “INSERT INTO users VALUES (' $name ', '$pwd')“; mysql_query ( $sql ); ?> send write user input database application 4

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Vulnerability (2) ● Database Read <?php $result = mysql_query ('SELECT * FROM users'); $row = mysql_fetch_assoc ( $result ); echo $row ['name']; ?> send write read user input database application 5

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Multi-Step Exploit (1) ● First-Order SQL injection <?php $name = $_POST ['name']; // ', 'payload')-- - $sql = “INSERT INTO users VALUES (' $name ', '$pwd')“; mysql_query ( $sql ); ?> send !“*$()&/'\ user input database application 6

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Multi-Step Exploit (1) ● Exploit First-Order SQL injection <?php $name = $_POST ['name']; // ', 'payload')-- - $sql = “INSERT INTO users VALUES (' $name ', '$pwd')“; mysql_query ( $sql ); ?> send write user input database application 7

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Multi-Step Exploit (2) ● Second-Order Command Execution <?php $result = mysql_query ('SELECT * FROM users'); $row = mysql_fetch_assoc ( $result ); system ('htpasswd -b .htpasswd Admin ' .$row ['pwd']); ?> request read database application 8

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Vulnerabilities User input Sensitive Sink Persistent Data Store (PDS) 1. 2. ● $_GET ● Databases ● Cross-Site Scripting ● $_POST ● File Names ● SQL Injection ● $_COOKIE ● $_SESSION (File Content) ● Code Execution ● $_FILES ... ● File Inclusion ● $_SERVER ● File Disclosure ... ... 9

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Vulnerabilities User input Sensitive Sink Persistent Data Store (PDS) 1. 2. ● $_GET ● Databases ● Cross-Site Scripting ● $_POST ● File Names ● SQL Injection ● $_COOKIE ● $_SESSION (File Content) ● Code Execution ● $_FILES ... ● File Inclusion ● $_SERVER ● File Disclosure ... ... 10

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Our Approach ● Static Code Analysis (no access to environment) ● Analyze writes and reads to persistent data stores ● Connect input and output points at the end of the analysis to detect second-order and multi-step vulnerabilities 11

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion 2. Implementation (Overview) Source: http://rewalls.com 12

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion First-Order Taint Analysis $name = $_POST ['name']; mysql_query ('insert into users values(null, ' $name ', ' $pwd '); 13

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion First-Order Taint Analysis $name = $_POST ['name']; mysql_query ('insert into users values(null, ' $name ', '$pwd'); 14

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion First-Order Taint Analysis $name = $_POST ['name']; mysql_query ('insert into users values(null, ' $name ', '$pwd'); 15

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion First-Order Taint Analysis $name = $_POST ['name']; Vulnerability Report POST[name] SQLi mysql_query ('insert into users values(null, ' $name ', '$pwd'); 16

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Taint Analysis (write) $name = escape ( $_POST ['name']); users mysql_query ('insert into users id name pass values(null, ' $name ', '$pwd'); 17

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Multi-Step Taint Analysis (write) $name = $_POST ['name']; Vulnerability Report POST[name] SQLi users mysql_query ('insert into users id name pass values(null, ' $name ', '$pwd'); 18

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Taint Analysis (read) PDS $res = mysql_query ('select name from users'); $row = mysql_fetch_assoc ( $res ); * echo ('Hi ' . $res ['name'] . ' !'); 19

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Taint Analysis (read) PDS $res = mysql_query ('select name from users'); Temporary Vulnerability Report users[name] $row XSS = mysql_fetch_assoc ( $res ); * echo ('Hi ' . $res ['name'] . ' !'); 22

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Taint Decision PDS connect Reads Writes users id name pass Temporary Vulnerability Report users[name] * XSS PDS' 23

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Taint Decision PDS Reads Writes users id name pass tainted? Temporary Vulnerability Report users[name] * XSS PDS' 24

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Taint Decision PDS Reads Writes users id name pass Temporary Vulnerability sanitized? Report users[name] * XSS PDS' 25

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Taint Decision PDS Reads Writes users id name pass Temporary Vulnerability Report users[name] * XSS Second-Order Vulnerability Report XSS PDS' 26

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion 3. Evaluation Source: http://rewalls.com 27

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Selected Software ● osCommerce 2.3.3.4 ● HotCRP 2.61 ● OpenConf 5.30 ● MyBloggie 2.1.4 ● NewsPro 1.1.5 ● Scarf 2007-02-27 28

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion PDS Usage and Coverage (first-order) Manually counted PDS (841) Non-Taintable 77% Taintable '"\<> Detected Taintable PDS 23% False Positive True Positive 6% False Negative 29% 71% PDS 29

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order Vulnerabilities ● 159 True Positives (79%) 97% persistent XSS (database)  Missed by previous work  ● 43 False Positives (21%) PDS Root cause: Path-sensitive sanitization  E.g., store only valid email  Failures in 1 st step propagate to 2 nd step  30

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Multi-Step Exploits ● 14 True Positives (93%) 2 based on file upload  12 based on SQLi  Missed by previous work  PDS ● 1 False Positives (7%) False positive SQLi  31

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order LFI in OpenConf PDS $r = mysql_query("select setting, value from " . OCC_TABLE_CONFIG); while ($l = mysql_fetch_assoc($r)) { $config[$l['setting']] = $l['value']; } function printHeader($what, $function="0") { require $GLOBALS['pfx'] . $GLOBALS['config']['OC_headerFile']; } 32

1. Introduction 2. Implementation 3. Evaluation 4. Conclusion Second-Order LFI in OpenConf PDS $r = mysql_query("select setting, value from " . OCC_TABLE_CONFIG); while ($l = mysql_fetch_assoc($r)) { $config[$l['setting']] = $l['value']; } function printHeader($what, $function="0") { require $GLOBALS['pfx'] . $GLOBALS['config']['OC_headerFile']; } 33

Static Detection of Second-Order Vulnerabilities in Web Applications - PowerPoint PPT Presentation

Static Detection of Second-Order Vulnerabilities in Web Applications Johannes Dahse and Thorsten Holz Ruhr-University Bochum USENIX Security 14, 20-22 August 2014, San Diego, CA, USA 1. Introduction 2. Implementation 3. Evaluation 4.

Static Detection and Automatic Exploitation of Intent Message Vulnerabilities in Android

Detection of Software Vulnerabilities: Static Analysis (Part I) Lucas Cordeiro Department of

Static Detection and Automatic Exploitation of Intent Message Vulnerabilities in Android

Detection of Software Vulnerabilities: Static Analysis (Part II) Lucas Cordeiro Department of

Customizing and Evolving Intrusion Detection A static, globally useful intrusion detection

Comparing the Effectiveness of Penetration Testing and Static Code Analysis Detection of SQL

Static Analysis for Memory Safety Salvatore Guarnieri sammyg@cs.washington.edu Papers A

Static Code Analysis of Complex PHP Application Vulnerabilities Johannes Dahse Static Code

Static analysis for exploitable vulnerability detection Marie-Laure Potet VERIMAG University of

RIPS RIPS A static source code analyser NDS Seminar for vulnerabilities in PHP scripts A

Why Cant Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools for

S MV -H UNTER : Large Scale, Automated Detection of SSL/TLS Man-in-the-Middle Vulnerabilities in

System Call Vulnerabilities in Linux Storage Stack Nima Mohammadi Sepand Haghighi Fall - 2016

SlowFuzz: Automated Domain-Independent Detection of Algorithmic Complexity Vulnerabilities

Using Static Program Analysis to Aid Intrusion Detection M. Egele M. Szydlowski E. Kirda C.

How Many of All Bugs Do We Find? A Study of Static Bug Detectors Andrew Habib, Michael Pradel TU

Compositional Static Race Detection at Scale, without False Positives Ilya Sergey Joint work

Improving MIMO Sphere Detection Through Antenna Detection Order Scheduling Michael Wu, Chris

Static Versioning of Global State for Race Condition Detection Steffen Keul Dept. of Programming

Physics 1 Overview Collision detection Model representation Dynamic vs. static

Using Static Checking To Find Security Vulnerabilities In The Linux Kernel Linuxcon Europe 2016

Apposcopy: Semantics- Based Detection of Android Malware through Static Analysis By Feng et al

Software Reliability Estimation Based on Static Error Detection M. Moiseev, M. Glukhikh , A.

Static Data Race Detection for SPMD Programs via an Extended Polyhedral Representation Prasanth