hybrid security analysis of web JavaScript code via dynamic partial evaluation

Size: px

Start display at page:

Download "hybrid security analysis of web JavaScript code via dynamic partial evaluation"

Howard Higgins
6 years ago
Views:

SIGSOFT International Symposium on Software

1 hybrid security analysis of web JavaScript code via dynamic partial evaluation Omer Tripp Pietro Ferrara Marco Pistoia! IBM Research, NY 1 Work published at the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2014) Recipient of the ACM SIGSOFT Distinguished Paper Award

2 web client-side code* 38% 30% 23% 15% 8% 25% 30% 0% 5% 9 years ago 4 years ago today 2 * data due to IBM application security research team

3 client-side vulnerabilities* DOM-based XSS var pos = document.location.href.indexof("name="); document.write(document.url.substring(pos, document.url.length)); open redirect var pos = document.location.href.indexof("target="); var val = document.location.href.substring(pos); document.location.href = " + val; >15% vulnerable to these attacks! 3 * data due to IBM application security research team

4 reflected XSS web app! script reflected into HTML response without proper encoding attacker s evil script executed using victim s credentials link embedded with evil script attacker! victim! 4!

5 DOM-based XSS ibm.com! NO reflection into HTML response evil script NOT sent to server name=<script> </script> attacker! victim! 5

6 client-side vulnerabilities* DOM-based XSS var pos = document.location.href.indexof("name="); document.write(document.url.substring(pos, document.url.length)); open redirect var pos = document.location.href.indexof("target="); var val = document.location.href.substring(pos); document.location.href = " + val; >15% vulnerable to these attacks! 6 * data due to IBM application security research team

7 open redirect ibm.com! attacker.com! 7 attacker! victim!

client-side vulnerabilities* DOM-based XSS var pos = document.location.href.indexof("name="); document.write(document.url.substring(pos, document.url.length)); open redirect var pos = document.

8 client-side vulnerabilities* DOM-based XSS var pos = document.location.href.indexof("name="); document.write(document.url.substring(pos, document.url.length)); open redirect var pos = document.location.href.indexof("target="); var val = document.location.href.substring(pos); document.location.href = " + val; >15% vulnerable to these attacks! 8 * data due to IBM application security research team

9 9! JavaScript complexities

10 JavaScript complexities eval and its relatives! eval("document.write('evil')"); 10!

11 JavaScript complexities reflective property access! var a = "foo" + "bar"; var b = obj[a]; 11!

12 JavaScript complexities arguments array! bar() { if (arguments.length > 3) foo(arguments[2]); } bar(1, x, 3) 12!

13 JavaScript complexities prototype-chain property lookup! function F() { this.f = document.location; } function G() { } G.prototype = new F(); var g = new G(); write(g.bar); 13!

14 JavaScript complexities function pointers! var m = function() { } var k = function(f) { f(); } k(m); 14!

15 JavaScript complexities lexical scoping! function foo() { var y = 42; var bar = function() { write(y); } } 15!

16 JavaScript complexities! 16!

17 motivating example var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); if (url_check > -1) { var result = str.substring(0, url_check); result = result + login.jsp + str.substring(url_check + search_term.length), str.length); document.url = result; // sink } (real-world JavaScript code from the Alcatel-Lucent website)! 17

$indexof(search_term); if (url_check > -1) { var result = str.$

18 motivating example var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); if (url_check > -1) { var result = str.substring(0, url_check); result = result + login.jsp + str.substring(url_check + search_term.length), str.length); document.url = result; // sink } (real-world JavaScript code from the Alcatel-Lucent website)! 18

19 taint analysis var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); if (url_check > -1) { var result = str.substring(0, url_check); result = result + login.jsp + str.substring(url_check + search_term.length), str.length); document.url = result; // sink } (real-world JavaScript code from the Alcatel-Lucent website)! 19

20 taint analysis var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); if (url_check > -1) { var result = str.substring(0, url_check); result = result + login.jsp + str.substring(url_check + search_term.length), str.length); document.url = result; // sink } (real-world JavaScript code from the Alcatel-Lucent website)! 20

21 taint analysis var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); if (url_check > -1) { var result = str.substring(0, url_check); result = result + login.jsp + str.substring(url_check + search_term.length), str.length); document.url = result; // sink } (real-world JavaScript code from the Alcatel-Lucent website)! 21

22 taint analysis var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); if (url_check > -1) { var result = str.substring(0, url_check); result = result + login.jsp + str.substring(url_check + search_term.length), str.length); document.url = result; // sink } (real-world JavaScript code from the Alcatel-Lucent website)! 22

23 taint analysis var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); if (url_check > -1) { var result = str.substring(0, url_check); result = result + login.jsp + str.substring(url_check + search_term.length), str.length); document.url = result; // sink } (real-world JavaScript code from the Alcatel-Lucent website)! 23

24 taint analysis var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); if (url_check > -1) { var result = str.substring(0, url_check); result = result + login.jsp + str.substring(url_check + search_term.length), str.length); document.url = result; // sink } BOOM?! (real-world JavaScript code from the Alcatel-Lucent website)! 24

25 dynamic partial evaluation var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); if (url_check > -1) { var result = str.substring(0, url_check); result = result + login.jsp + str.substring(url_check + search_term.length), str.length); document.url = result; // sink } (real-world JavaScript code from the Alcatel-Lucent website)! 25

26 dynamic partial evaluation var search_term = login.html ; var str = document.location; ; var url_check = str.indexof(search_term); if (url_check > -1) { var result = ; str.substring(0, url_check); result= ; result + login.jsp + str.substring(url_check + search_term.length),str.length); document.url = result; } (real-world JavaScript code from the Alcatel-Lucent website)! 26

$indexof(search_term); if (url_check > -1) { var result = http://x.com/ ; result= http://x.com/login.jsp?p1=v1 ; document.$

27 dynamic partial evaluation var search_term = login.html ; var str = ; var url_check = str.indexof(search_term); if (url_check > -1) { var result = ; result= ; document.url = result; } (real-world JavaScript code from the Alcatel-Lucent website)! 27

28 our hybrid approach Dynamic Oracle! Crawls Web site! Collects dynamic information! Links references to the DOM with partially concretized values! GET var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); var search_term = login.html ; var str = ; var url_check = str.indexof(search_term); Traditional Static Taint Analysis! Looks for flows from sources to sinks! Static String Analysis! Determines which parts of a string are beyond user control! Leverages string information for better classification of findings! 28

29 our hybrid approach Dynamic Oracle! Crawls Web site! Collects dynamic information! Links references to the DOM with partially concretized values! GET var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); accuracy! var search_term = login.html ; var str = ; var url_check = str.indexof(search_term); Traditional Static Taint Analysis! Looks for flows from sources to sinks! Static String Analysis! Determines which parts of a string are beyond user control! Leverages string information for better classification of findings! 29

30 our hybrid approach Dynamic Oracle! Crawls Web site! Collects dynamic information! Links references to the DOM with partially concretized values! GET var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); coverage! var search_term = login.html ; var str = ; var url_check = str.indexof(search_term); Traditional Static Taint Analysis! Looks for flows from sources to sinks! Static String Analysis! Determines which parts of a string are beyond user control! Leverages string information for better classification of findings! 30

our hybrid approach Dynamic Oracle! Crawls Web site! Collects dynamic information! Links references to the DOM with partially concretized values! GET http://x.com/login.html?p1=v1!

31 our hybrid approach Dynamic Oracle! Crawls Web site! Collects dynamic information! Links references to the DOM with partially concretized values! GET var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); var search_term = login.html ; var str = document.url; // source var url_check = str.indexof(search_term); lightweight! var search_term = login.html ; var str = ; var url_check = str.indexof(search_term); Traditional Static Taint Analysis! Looks for flows from sources to sinks! Static String Analysis! Determines which parts of a string are beyond user control! Leverages string information for better classification of findings! 31

32 static analysis: JSA intuition document.location system-controlled prefix attacker-controlled suffix 32

33 static analysis: JSA domain var str = document.location; var lstr = str.tolowercase(); var n = lstr.indexof( login.html ); if (n > -1) { var tmp = str.substring(0,n); document.location.href = tmp; } 33

34 static analysis: JSA domain var str = ; var lstr = str.tolowercase(); var n = lstr.indexof( login.html ); if (n > -1) { var tmp = str.substring(0,n); document.location.href = tmp; } 34

35 static analysis: JSA domain Prx Idx var str = ; {str}, var lstr = str.tolowercase(); var n = lstr.indexof( login.html ); if (n > -1) { var tmp = str.substring(0,n); document.location.href = tmp; } 35

36 static analysis: JSA domain Prx Idx var str = ; {str}, var lstr = str.tolowercase(); var n = lstr.indexof( login.html ); if (n > -1) { var tmp = str.substring(0,n); {str}, {lstr}, document.location.href = tmp; } 36

37 static analysis: JSA domain Prx Idx var str = ; {str}, var lstr = str.tolowercase(); var n = lstr.indexof( login.html ); if (n > -1) { var tmp = str.substring(0,n); {str}, {lstr}, } document.location.href = tmp; {str}, {lstr}, {n: 13} 37

38 static analysis: JSA domain Prx Idx var str = ; {str}, var lstr = str.tolowercase(); var n = lstr.indexof( login.html ); if (n > -1) { var tmp = str.substring(0,n); {str}, {lstr}, } document.location.href = tmp; {str}, {lstr}, {n: 13} {str}, {lstr}, {tmp}, {n: 13} 38

39 static analysis: JSA domain Prx Idx var str = ; {str}, var lstr = str.tolowercase(); var n = lstr.indexof( login.html ); if (n > -1) { var tmp = str.substring(0,n); {str}, {lstr}, } document.location.href = tmp; {str}, {lstr}, {n: 13} {str}, {lstr}, {tmp}, {n: 13} 39

40 static analysis: JSA transformers Prx Idx var str = ; {str}, var lstr = str.tolowercase(); var n = lstr.indexof( login.html ); if (n > -1) { var tmp = str.substring(0,n); {str}, {lstr}, document.location.href = tmp; } 40

41 static analysis: JSA transformers Prx Idx var str = ; {str}, var lstr = str.tolowercase(); var n = lstr.indexof( login.html ); if (n > -1) { var tmp = str.substring(0,n); {str}, {lstr}, } document.location.href = tmp; {str}, {lstr}, {n: 13} 41

static analysis: JSA transformers Prx Idx var str = HTTP://X.Com/login.html?p1=v1 ; {str},http://x.com/login.html?,t var lstr = str.tolowercase(); var n = lstr.indexof( login.

42 static analysis: JSA transformers Prx Idx var str = ; {str}, var lstr = str.tolowercase(); var n = lstr.indexof( login.html ); if (n > -1) { var tmp = str.substring(0,n); {str}, {lstr}, } document.location.href = tmp; {str}, {lstr}, {n: 13} {str}, {lstr}, {tmp}, {n: 13} 42

43 note on implementation JSA written atop the WALA framework IFDS problem / distributive analysis optimization: staged analysis 1st stage: taint analysis 2nd stage: JSA applied to source/sink pairs not eliminated by taint analysis featured in IBM Security AppScan Standard Edition (AppScan Std) V8.6 43

44 evaluation benchmarks 170,000 webpages / 675 websites: Fortune 500 top 100 ( handpicked security and IT websites up to 500 pages per site via nonintrusive crawling no login only link crawling 44

45 evaluation benchmarks var pageurl = window.location; var cid = document.getelementbyid("ctl00_contentplaceholder1_hdncontentid").value; var url = "/CMS/OverviewPrint.aspx?id=" + cid + "&url=" + pageurl; openpopupwindow(url); (from the Corning website)! var url = window.location.href; var i = url.indexof("?"); if (i>0) {url=url.substring(0, i); i = url.indexof( /ntopic/");} if (i<0) { return; } url = url.substring(0, i+1); url = url+"livehelp/?pluginid="+a; window.location.href = url; (from the IBM Team Concert website)! 45

46 evaluation benchmarks var pageurl = window.location; var cid = document.getelementbyid("ctl00_contentplaceholder1_hdncontentid").value; var url = "/CMS/OverviewPrint.aspx?id=" + cid + "&url=" + pageurl; openpopupwindow(url); (from the Corning website)! Both cid and pageurl flow into the! target URL s query string, after the?! var url = window.location.href; var i = url.indexof("?"); if (i>0) {url=url.substring(0, i); i = url.indexof( /ntopic/");} if (i<0) { return; } url = url.substring(0, i+1); url = url+"livehelp/?pluginid="+a; window.location.href = url; (from the IBM Team Concert website)! 46

evaluation benchmarks var pageurl = window.location; var cid = document.getelementbyid("ctl00_contentplaceholder1_hdncontentid").value; var url = "/CMS/OverviewPrint.aspx?

47 evaluation benchmarks var pageurl = window.location; var cid = document.getelementbyid("ctl00_contentplaceholder1_hdncontentid").value; var url = "/CMS/OverviewPrint.aspx?id=" + cid + "&url=" + pageurl; openpopupwindow(url); (from the Corning website)! Both cid and pageurl flow into the! target URL s query string, after the?! var url = window.location.href; var i = url.indexof("?"); if (i>0) {url=url.substring(0, i); i = url.indexof( /ntopic/");} if (i<0) { return; } url = url.substring(0, i+1); url = url+"livehelp/?pluginid="+a; window.location.href = url; 47 (from the IBM Team Concert website)! Computes a prefix of the URL string that! lies within the host path, and appends! constant string livehelp/?pluginid=

48 1st experiment: comparison with taint analysis compared against commercial taint analysis (used in AppScan Std V8.5) entire set of webpages manual classification of results by professional ethical hacker (from IBM application security team): TP/FP 48

49 1st experiment: results TPs FPs 90% reduction!! 4, , ,639 0 JSA taint analysis 49

50 evaluation FPs? function changezipredirect(zipcoderedirect) { var currurl = document.location.href;...; wcmcontext = currurl.split( WCM GLOBAL CONTEXT ); var redirectstr = wcmcontext[1];...; if (redirectstr.match( pmapmc= ) == null) { / redirect to the zipcode page / document.location.href = zipcoderedirect + &redirecturl + redirectstr; } } (from the Alltel website)! 50

51 evaluation FPs? function changezipredirect(zipcoderedirect) { var currurl = document.location.href;...; wcmcontext = currurl.split( WCM GLOBAL CONTEXT ); var redirectstr = wcmcontext[1];...; if (redirectstr.match( pmapmc= ) == null) { / redirect to the zipcode page / document.location.href = zipcoderedirect + &redirecturl + redirectstr; } } (from the Alltel website)! 51

evaluation FPs? function changezipredirect(zipcoderedirect) { var currurl = document.location.href;...; wcmcontext = currurl.split( WCM GLOBAL CONTEXT ); var redirectstr = wcmcontext[1];.

52 evaluation FPs? function changezipredirect(zipcoderedirect) { var currurl = document.location.href;...; wcmcontext = currurl.split( WCM GLOBAL CONTEXT ); var redirectstr = wcmcontext[1];...; if (redirectstr.match( pmapmc= ) == null) { / redirect to the zipcode page / document.location.href = zipcoderedirect + &redirecturl + redirectstr; } } (from the Alltel website)! unresolved constant! 52

53 2nd experiment: comparison with black-box testing compared against commercial testing engine (that of AppScan Std V8.6) ~10% (60 / 675) of websites sampled at random website fragment retrieved by crawler deployed locally for intrusive testing 53

54 2nd experiment: results configuration! vulnerable websites! false positives! JSA enabled! 33! 4! JSA disabled! 8! 0! 54

55 conclusion JavaScript security: a BIG deal taint analysis: poor user experience (>60% FPs!) the key: dynamic partial evaluation high coverage precision boost with low overhead JSA: novel form of string analysis scalable (staged solution atop taint analysis) 90% reduction in FPs! 55

56 <script> alert( thank you! ) </script> 56

ISSTA : Software Testing and Analysis TAJ: Effective Taint Analysis of Web Applications, PLDI 2009

Slide 1 Hybrid Security Analysis of Web JavaScript Code via Dynamic Partial Evaluation Omer Tripp, Pietro Ferrara, Marco Pistoia IBM Watson Research Center ISSTA 2014 ISSTA : Software Testing and Analysis