DMCA
Sound and Precise Analysis of Web Applications for Injection Vulnerabilities (2007)
Cached
Download Links
| Venue: | PLDI'07 |
| Citations: | 161 - 5 self |
BibTeX
@MISC{Wassermann07soundand,
author = {Gary Wassermann and Zhendong Su},
title = { Sound and Precise Analysis of Web Applications for Injection Vulnerabilities },
year = {2007}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Web applications are popular targets of security attacks. One common type of such attacks is SQL injection, where an attacker exploits faulty application code to execute maliciously crafted database queries. Both static and dynamic approaches have been proposed to detect or prevent SQL injections; while dynamic approaches provide protection for deployed software, static approaches can detect potential vulnerabilities before software deployment. Previous static approaches are mostly based on tainted information flow tracking and have at least some of the following limitations: (1) they do not model the precise semantics of input sanitization routines; (2) they require manually written specifications, either for each query or for bug patterns; or (3) they are not fully automated and may require user intervention at various points in the analysis. In this paper, we address these limitations by proposing a precise, sound, and fully automated analysis technique for SQL injection. Our technique avoids the need for specifications by considering as attacks those queries for which user input changes the intended syntactic structure of the generated query. It checks conformance to this policy by conservatively characterizing the values a string variable may assume with a context free grammar, tracking the nonterminals that represent user-modifiable data, and modeling string operations precisely as language transducers. We have implemented the proposed technique for PHP, the most widely-used web scripting language. Our tool successfully discovered previously unknown and sometimes subtle vulnerabilities in real-world programs, has a low false positive rate, and scales to large programs (with approx. 100K loc).
Keyphrases
web application sql injection precise analysis injection vulnerability dynamic approach previous static approach tainted information flow tracking analysis technique low false positive rate real-world program context free grammar subtle vulnerability widely-used web faulty application code user-modifiable data software deployment various point database query generated query intended syntactic structure potential vulnerability input sanitization routine user input language transducer large program precise semantics popular target string variable following limitation security attack static approach common type bug pattern
