Fear the EAR: discovering and mitigating execution after redirect vulnerabilities

The complexity of modern web applications makes it difficult for developers to fully understand the security implications of their code. Attackers exploit the resulting security vulnerabilities to gain unauthorized access to the web application environment. Previous research into web application vulnerabilities has mostly focused on input validation flaws, such as cross-site scripting and SQL injection, while logic flaws have received comparably less attention. In this paper, we present a comprehensive study of a relatively unknown logic flaw in web applications, which we call Execution After Redirect, or EAR. A web application developer can introduce an EAR by calling a redirect method under the assumption that execution will halt. A vulnerability occurs when server-side execution continues after the developer’s intended halting point, which can lead to broken/insufficient access controls and information leakage. We start with an analysis of how susceptible applications written ...

• Type: Journal
• Year: 2011
• Where: CCS
• Authors: Adam Doupé, Bryce Boe, Christopher Kruegel, Giovanni Vigna
• Keywords: CCS 2011, Security Privacy, Static Analysis Tool, Web Application Developer, Web Application Environment