Ghostrail: Ad Hoc Control-Flow Integrity for Web Applications

Abstract : Modern web applications frequently implement complex control flows, which require the users to perform actions in a given order. Users interact with a web application by sending HTTP requests with parameters and in response receive web pages with hyperlinks that indicate the expected next actions. If a web application takes for granted that the user sends only those expected requests and parameters, malicious users can exploit this assumption by crafting harming requests. We analyze recent attacks on web applications with respect to user-defined requests and identify their root cause in the missing enforcement of allowed next user requests. Based on this result, we provide our approach, named Ghostrail, a control-flow monitor that is applicable to legacy as well as newly developed web applications. It observes incoming requests and lets only those pass that were provided as next steps in the last web page. Ghostrail protects the web application against race condition exploits, the manipulation of HTTP parameters, unsolicited request sequences, and forceful browsing. We evaluate the approach and show that it neither needs a training phase nor a manual policy definition while it is suitable for a broad range of web technologies.
Type de document :
Communication dans un congrès
Nora Cuppens-Boulahia; Frédéric Cuppens; Sushil Jajodia; Anas Abou El Kalam; Thierry Sans. 29th IFIP International Information Security Conference (SEC), Jun 2014, Marrakech, Morocco. Springer, IFIP Advances in Information and Communication Technology, AICT-428, pp.264-277, 2014, ICT Systems Security and Privacy Protection. 〈10.1007/978-3-642-55415-5_22〉
Liste complète des métadonnées

Littérature citée [17 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-01370372
Contributeur : Hal Ifip <>
Soumis le : jeudi 22 septembre 2016 - 14:26:23
Dernière modification le : jeudi 22 septembre 2016 - 15:11:03

Fichier

978-3-642-55415-5_22_Chapter.p...
Fichiers produits par l'(les) auteur(s)

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Bastian Braun, Caspar Gries, Benedikt Petschkuhn, Joachim Posegga. Ghostrail: Ad Hoc Control-Flow Integrity for Web Applications. Nora Cuppens-Boulahia; Frédéric Cuppens; Sushil Jajodia; Anas Abou El Kalam; Thierry Sans. 29th IFIP International Information Security Conference (SEC), Jun 2014, Marrakech, Morocco. Springer, IFIP Advances in Information and Communication Technology, AICT-428, pp.264-277, 2014, ICT Systems Security and Privacy Protection. 〈10.1007/978-3-642-55415-5_22〉. 〈hal-01370372〉

Partager

Métriques

Consultations de la notice

51

Téléchargements de fichiers

9