Patching Logic Vulnerabilities for Web Applications using LogicPatcher

ABSTRACT

Logic vulnerabilities are an important class of programming flaws in web applications. These vulnerabilities occur when a desired property pertaining to an application's logic does not hold along certain paths in the application's code. Many analysis tools have been developed to find logic vulnerabilities in web applications. Given a web application with logic vulnerabilities, the question is whether one can design methods to patch application code and prevent these vulnerabilities from being exploited. We answer this question by developing an approach and tool called LogicPatcher for patching of logic vulnerabilities. We focus on correct patch placement, i.e. identifying the precise location in code where the patch code can be introduced, based on path profiling. As we show in this paper, finding the appropriate location as well as generating the right patch can get complicated and require deep code analysis. We demonstrate the utility of LogicPatcher by automatically fixing several critical parameter tampering and authorization vulnerabilities in large web applications.

References

1. Sans critical security controls for effective cyber defense, 2015.
2. Aho, A. V., Sethi, R., and Ullman, J. D. Compilers: Principles, Techniques, and Tools. Addison-Wesley Longman Publishing Co., Inc., Boston, MA, USA, 1986.
3. Alkhalaf, M., Choudhary, S. R., Fazzini, M., Bultan, T., Orso, A., and Kruegel, C. Viewpoints: Differential string analysis for discovering client- and server-side input validation inconsistencies. In Proceedings of the 2012 International Symposium on Software Testing and Analysis (New York, NY, USA, 2012), ISSTA 2012, ACM, pp. 56--66.
4. Andersen, J., and Lawall, J. L. Generic patch inference. In 23rd IEEE/ACM International Conference on Automated Software Engineering ASE 08 (2008).
5. Ball, T., and Larus, J. R. Efficient path profiling. In Proceedings of the 29th Annual ACM/IEEE International Symposium on Microarchitecture (Washington, DC, USA, 1996), MICRO 29, IEEE Computer Society, pp. 46--57.
6. Bisht, P., Hinrichs, T., Skrupsky, N., Bobrowicz, R., and Venkatakrishnan, V. N. Notamper: Automatic blackbox detection of parameter tampering opportunities in web applications. In Proceedings of the 17th ACM Conference on Computer and Communications Security (New York, NY, USA, 2010), CCS '10, ACM, pp. 607--618.
7. Bisht, P., Hinrichs, T., Skrupsky, N., and Venkatakrishnan, V. N. Waptec: Whitebox analysis of web applications for parameter tampering exploit construction. In Proceedings of the 18th ACM Conference on Computer and Communications Security (New York, NY, USA, 2011), CCS '11, ACM, pp. 575--586.
8. Bisht, P., Sistla, A. P., and Venkatakrishnan, V. N. Taps: Automatically preparing safe sql queries. In Proceedings of the 17th ACM Conference on Computer and Communications Security (New York, NY, USA, 2010), CCS '10, ACM, pp. 645--647.
9. Felmetsger, V., Cavedon, L., Kruegel, C., and Vigna, G. Toward automated detection of logic vulnerabilities in web applications. In Proceedings of the 19th USENIX Conference on Security (Berkeley, CA, USA, 2010), USENIX Security'10, USENIX Association, pp. 10--10.
10. Ganapathy, V., Jaeger, T., and Jha, S. Automatic placement of authorization hooks in the Linux Security Modules framework. In Proceedings of the 12th ACM Conference on Computer and Communications Security (Nov. 2005), pp. 330--339.
11. Ganapathy, V., Jaeger, T., and Jha, S. Retrofitting legacy code for authorization policy enforcement. 2012 IEEE Symposium on Security and Privacy 0 (2006), 214--229.
12. Jin, G., Song, L., Zhang, W., Lu, S., and Liblit, B. Automated atomicity-violation fixing. In Proceedings of the 32Nd ACM SIGPLAN Conference on Programming Language Design and Implementation (2011).
13. Jovanovic, N., Kruegel, C., and Kirda, E. Pixy: A static analysis tool for detecting web application vulnerabilities (short paper). In Proceedings of the 2006 IEEE Symposium on Security and Privacy (Washington, DC, USA, 2006), SP '06, IEEE Computer Society, pp. 258--263.
14. Livshits, B., and Chong, S. Towards fully automatic placement of security sanitizers and declassifiers. In Proceedings of the 40th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (New York, NY, USA, 2013), POPL '13, ACM, pp. 385--398.
15. Monshizadeh, M., Naldurg, P., and Venkatakrishnan, V. N. Mace: Detecting privilege escalation vulnerabilities in web applications. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security (New York, NY, USA, 2014), CCS '14, ACM, pp. 690--701.
16. Pellegrino, G., and Balzarotti, D. Toward black-box detection of logic flaws in web applications. In NDSS 2014, Network and Distributed System Security Symposium, 23--26 February 2014, San Diego, USA (2014).
17. Perkins, J. H., Kim, S., Larsen, S., Amarasinghe, S., Bachrach, J., Carbin, M., Pacheco, C., Sherwood, F., Sidiroglou, S., Sullivan, G., Wong, W.-F., Zibin, Y., Ernst, M. D., and Rinard, M. Automatically patching errors in deployed software. In Proceedings of the ACM SIGOPS 22Nd Symposium on Operating Systems Principles SOSP 09 (2009).
18. Son, S., McKinley, K. S., and Shmatikov, V. Rolecast: finding missing security checks when you do not know what checks are. In Proceedings of the 2011 ACM international conference on Object oriented programming systems languages and applications (New York, NY, USA, 2011), OOPSLA '11, ACM, pp. 1069--1084.
19. Son, S., Mckinley, K. S., and Shmatikov, V. Fix me up: Repairing access-control bugs in web applications. In In Network and Distributed System Security Symposium (2013).
20. Son, S., and Shmatikov, V. Saferphp: Finding semantic vulnerabilities in php applications. In ACM PLAS (2011).
21. Srivastava, V., Bond, M. D., McKinley, K. S., and Shmatikov, V. A security policy oracle: Detecting security holes using multiple api implementations. In Proceedings of the 32Nd ACM SIGPLAN Conference on Programming Language Design and Implementation (2011).
22. Tan, L., Zhang, X., Ma, X., Xiong, W., and Zhou, Y. utoises: Automatically inferring security specifications and detecting violations. In Proceedings of the 17th Usenix Security Symposium (2008).
23. Vijayakumar, H., Ge, X., Payer, M., and Jaeger, T. Jigsaw: Protecting resource access by inferring programmer expectations. In Proceedings of the 23rd USENIX Conference on Security Symposium (Berkeley, CA, USA, 2014), SEC'14, USENIX Association, pp. 973--988.

Index Terms

• Security and privacy

  • Security services

    • Access control

• Software and its engineering

  • Software organization and properties

    • Software functional properties

      • Formal methods

        • Automated static analysis

        • Software verification