A String Constraint Solver for Detecting Web Application Vulnerability Xiang Fu Hofstra University Chung-Chih Li Illinois State University 07/03/2010SEKES 20101

Outline  Motivation  General Context: Static Analysis + String Constraint Solving  Constraint Solving Technique  Regular Replacement  Application & Experimental Data  Conclusion 07/03/2010SEKES 20102

Vulnerable Web Applications  Web App. Successful for Decade!  Public Accessibility  Vulnerability 70% “ Today over 70% of attacks against a company’s website or web application come at the ‘Application Layer’ not the network or system layer.” - Gartner Group 07/03/2010SEKES 20103

SQL Injection Trick admin’--abc Example: uname “ admin’-- ”, pwd as “abc” SELECT uname, pwd FROM users WHERE uname = ’ ’AND pwd=’ ’ -- comments out rest Log-in w/o pwd! string sState = “SELECT uname, pwd FROM users \n” + ’ “WHERE uname = ’” + + ’’’ “’ ANDpwd =’” + + “’” admin’--abc tUname.txt tPwd.txt 07/03/2010SEKES 20104

Challenges  User Input Validation – the Cure? Programmers are Human Being! 07/03/2010SEKES 20105

String massage(String strInput) { String sOut = strInput.Replace("’","’’"); sOut = sOut.Substring(0,16); return sOut; } Input Validation Not Easy Generate Escaping Character of SINGLE QUOTE Limit String Size Chop off after 16 th char 07/03/2010SEKES Can you find an attack against massage?

Bugs! ’ OR uname<>’ 16 String length: 16 user name password 07/03/2010SEKES 20107

The Cracking Process String massage(String strInput) { ’’’ String sOut = strInput.Replace("’","’’"); 16 sOut = sOut.Substring(0,16); return sOut; } ’ ’’ ’ 07/03/2010SEKES 20108

SQL Statement Constructed SELECT uname,pwd FROM users WHERE uname=’ ’’ AND pwd=’ OR uname<>’’ Treated as one single quote Condition 1 tautology! Condition 2 tautology! 07/03/2010SEKES 20109

Lessons Learned  Bugs  Delicate SQL Injection Vul.  Need Tools for Inspecting Security Holes Smartly and Automatically 07/03/2010SEKES

General Approach: (COMPSAC’07) Symbolic Execution + String Solver Bytecode Instrumentor String Solver Test Case Generator Sym. Execution Engine Attack Pattern Library bytecode instrumented bytecode x + “zbc” = y? x=.. y=.. 07/03/2010SEKES

SUSHI Constraint Solver 07/03/2010SEKES Undecidable! Application Expressiveness

Simple Linear String Equation String Expression = RegExp 07/03/2010SEKES Variables occur only on LHS Support all string freq ops: Substring, indexing, replacement, concatenation

Example (Password Bypass) 07/03/2010SEKES = RHS LHS Apply massage on x: replacement and substring

Solution Algorithm  (1) Break to Atomic Steps  (2) Represent in Finite State Transducer  (3) Symbolic Image Computation  (4) Chain Results => Solution Pool  (5) Solution Pool => Concrete Solution 07/03/2010SEKES

Special Challenge (NFM’10)  Regular Replacement  Many Semantics! Greedy Reluctant Declarative …  Special Algorithm for Precise Modeling 07/03/2010SEKES

Finite State Transducer  Accepts Regular Relation  Union, Concat, Composition  Intersection, Complement  Used for Modeling Rewriting Rules [Kaplan94, Karttunen96] 04/13/2010NFM ε: a:2 b:3 A (ab,123) ∈ L(A)

04/13/2010NFM Step 1: Begin Marker Step 2: ND End Marker Step 3: Pairing Markers Step 4: Checking Match Step 5: Check Longest Step 6: Replacement a +  x Search Pattern aabab #a#ab#ab #a#a$b#ab #a$#a$b#a$b #a#a$b#a$b #aa$b#a$b xbxb #a#ab#a$b #aaba$b One Input Word  One Output Word Modeling Greedy Semantics (NFM’2010)

Deal with Unicode Alphabet  Explicit Rep. of Transition Not Working!  Compact Representation Symbolic Transition Set Special Alg. For FST Composition etc. 04/13/2010NFM

Efficiency of Solver 04/13/2010NFM Login Servlet 1.4 Seconds on 2Ghz PC Bench Mark Equations

More Applications: XSS Attack  Vul. Originally Reported in SecTrack #  Adobe Flex SDK 3.3  SUSHI found Much Shorter Attack Signature 07/03/2010SEKES Equation Size: Seconds

Related Work  Forward String Analysis Christensen & Møller [SAS’03] Wasserman & Su [PLDI’07, ICSE’08] Bjørner & Tillmann [TACAS’09]  Backward String Analysis Kiezun & Ganesh [ISSTA’09] Yu & Bultan [SPIN’08, ASE’09] Fu [COMPSAC’07, TAVWEB’08]  Natural Language Processing * Kaplan and Kay [CL’1994] 04/13/2010NFM Our Contribution: Precise Modeling of Various Regular Substitution Semantics  Precise Security Analysis ?? Compare with Bit- blasting??

Conclusion  FST based String Constraint Solving  Applied to Security Analysis SQL Injection XSS Attack More …  More Expressive Extension of SISE 07/03/2010SEKES

Questions? 07/03/2010SEKES