Precise alias analysis for static detection of web application vulnerabilities

13 years 10 months ago

Download www.seclab.tuwien.ac.at

The number and the importance of web applications have increased rapidly over the last years. At the same time, the quantity and impact of security vulnerabilities in such applications have grown as well. Since manual code reviews are time-consuming, errorprone and costly, the need for automated solutions has become evident. In this paper, we address the problem of vulnerable web applications by means of static source code analysis. To this end, we present a novel, precise alias analysis targeted at the unique reference semantics commonly found in scripting languages. Moreover, we enhance the quality and quantity of the generated vulnerability reports by employing a novel, iterative two-phase algorithm for fast and precise resolution of ﬁle inclusions. We integrated the presented concepts into Pixy [14], a highprecision static analysis tool aimed at detecting cross-site scripting vulnerabilities in PHP scripts. To demonstrate the effectiveness of our techniques, we analyzed three we...

Nenad Jovanovic, Christopher Kruegel, Engin Kirda

Real-time Traffic