Sciweavers

Share
CCS
2011
ACM

Fear the EAR: discovering and mitigating execution after redirect vulnerabilities

8 years 2 months ago
Fear the EAR: discovering and mitigating execution after redirect vulnerabilities
The complexity of modern web applications makes it difficult for developers to fully understand the security implications of their code. Attackers exploit the resulting security vulnerabilities to gain unauthorized access to the web application environment. Previous research into web application vulnerabilities has mostly focused on input validation flaws, such as cross-site scripting and SQL injection, while logic flaws have received comparably less attention. In this paper, we present a comprehensive study of a relatively unknown logic flaw in web applications, which we call Execution After Redirect, or EAR. A web application developer can introduce an EAR by calling a redirect method under the assumption that execution will halt. A vulnerability occurs when server-side execution continues after the developer’s intended halting point, which can lead to broken/insufficient access controls and information leakage. We start with an analysis of how susceptible applications written ...
Adam Doupé, Bryce Boe, Christopher Kruegel,
Added 13 Dec 2011
Updated 13 Dec 2011
Type Journal
Year 2011
Where CCS
Authors Adam Doupé, Bryce Boe, Christopher Kruegel, Giovanni Vigna
Comments (0)
books