Static analysis of PHP applications

Size: px

Start display at page:

Download "Static analysis of PHP applications"

Tabitha Bennett
5 years ago
Views:

1 Static analysis of PHP applications Ondřej Šerý DISTRIBUTED SYSTEMS RESEARCH GROUP CHARLES UNIVERSITY PRAGUE Faculty of Mathematics and Physics

2 References G. Wassermann, Z. Su: Static Detection of Cross-Site Scripting Vulnerabilities, Proceedings of 30 th International Conference on Software Engineering (ICSE 08). G. Wassermann, Z. Su: Sound and Precise Analysis of Web Applications for Injection Vulnerabilities, Proceedings of Programming Language Design and Implementation (PLDI 07). 2

3 PHP application vulnerability example <?php $user = $_GET["user"]; $query = "SELECT text FROM notes WHERE user_id = '$user'"; $result = mysql_query($query); $num = mysql_numrows($result); echo "<h1>your notes</h1>"; $i = 0; while ($i < $num) { $text = mysql_result($result, $i++, "text"); echo "<b>note #$i</b>$text<br>"; }?> 3

4 PHP application vulnerability example <?php $user = $_GET["user"]; $user = str_replace("'","''", $user); $query = "SELECT text FROM notes WHERE user_id = '$user'"; $result = mysql_query($query); $num = mysql_numrows($result); echo "<h1>your notes</h1>"; $i = 0; while ($i < $num) { $text = mysql_result($result, $i++, "text"); echo "<b>note #$i</b>$text<br>"; }?> 4

5 PHP application vulnerability example <?php $user = $_GET["user"]; $user = addslashes($user); $query = "SELECT text FROM notes WHERE user_id = '$user'"; $result = mysql_query($query); $num = mysql_numrows($result); echo "<h1>your notes</h1>"; $i = 0; while ($i < $num) { $text = mysql_result($result, $i++, "text"); echo "<b>note #$i</b>$text<br>"; }?> 5

6 PHP application vulnerability example <?php $user = $_GET["user"]; $user = mysql_real_escape_string($user); $query = "SELECT text FROM notes WHERE user_id = '$user'"; $result = mysql_query($query); $num = mysql_numrows($result); echo "<h1>your notes:</h1>"; $i = 0; while ($i < $num) { $text = mysql_result($result, $i++, "text"); echo "<b>note $i</b>$text<br/>"; }?> 6

7 PHP application vulnerability example <?php $user = $_GET["user"]; $user = mysql_real_escape_string($user); $query = "SELECT text FROM notes WHERE user_id = '$user'"; $result = mysql_query($query); $num = mysql_numrows($result); echo "<h1>your notes:</h1>"; }?> $i = 0; while ($i < $num) { $text = mysql_result($result, $i++, "text"); echo "<b>note $i</b>$text<br/>"; <script> document.location=' +document.cookie </script> 7

8 PHP application vulnerability example <?php $user = $_GET["user"]; $user = mysql_real_escape_string($user); $query = "SELECT text FROM notes WHERE user_id = '$user'"; $result = mysql_query($query); $num = mysql_numrows($result); echo "<h1>your notes:</h1>"; $i = 0; while ($i < $num) { $text = mysql_result($result, $i++, "text"); echo "<b>note $i</b>$text<br/>"; }?> <a href="javascript:document.location= ' </a> 8

9 Web application errors (SQLI, XSS) Considered the most dangerous bugs e.g. CWE ( 1) Cross-site scripting (XSS) 2) SQL Injection (SQLI) 3) Buffer overflow Exposition Large attack surface 24/7 exposition to an attacker 9

10 Motivation PHP is very popular Over domains 3 rd most popular language (March 2010) Based on Extremely easy to: Start Tons of tutorials Available on almost all web hostings Do it wrong! Prone to attacks SQLI, XSS Confusion addslashes() vs. pg_escape_string() Too many crappy information sources 10

11 Motivation Try google PHP Tutorial First 4 results that even get to DB access Not a single one shows SQLI protection right 1 downright wrong 2 at least mentioned the risk Inappropriate solution e.g., str_replace("'","''", $payload); 1 does not pass user input to the query No WHERE clause used XSS not mentioned like ever 11

12 Specifics and challenges? Dynamic nature Loss of semantics (and compiler checks) eval $meta_code_for_fun; Different levels of execution Server, DB Server, Client Little data and code separation The NX bit all over again Focus on strings Very precise information is necessary 12

13 Approaches (1) Client-side Crawling the website Pass invalid data to cause error / indicate XSS weakness For a list specific to XSS see, e.g., Concolic testing Find input to increase coverage Not specific to XSS In-browser protection BrowserShield Filters JavaScript to known vulnerabilities From a central server Not specific to XSS Beep (Browser-Enforced Embedded Policies) Browser asks the server to authorize trusted scripts Hard to deploy Both servers and clients have to be adapted 13

14 Approaches (2) Server-side Taint analysis Dataflow graph Sources, sanitizers, sinks How to find them? User classification Statistical guess Merlin Source: $data = _GET[ data ] $data = strtoupper ($data) Sanitizer: $safe = addslashes($data) Sink: mysql_query($query) Tainted $query = SELECT... $safe ; 14

15 Approaches (3) Server-side Static string analysis Symbolically represent possible string values More fine-grained that pure taint analysis 15

16 Static Detection of XSS Vulnerabilities Key idea: Set of string values Context-free grammar (CFG) String operations (e.g., stripslashes) Finite State Transducer (FST) A = \{ } B = \{ \} Taken from: G. Wassermann, Z. Su: Static Detection of Cross-Site Scripting Vulnerabilities, Proceedings of ICSE 08 Note: Image of CFG over FST CFG 16

17 Running example Taken from: G. Wassermann, Z. Su: Static Detection of Cross-Site Scripting Vulnerabilities, Proceedings of ICSE 08 17

18 Taken from: G. Wassermann, Z. Su: Static Detection of Cross-Site Scripting Vulnerabilities, Proceedings of ICSE 08 18

19 SSA form Taken from: G. Wassermann, Z. Su: Static Detection of Cross-Site Scripting Vulnerabilities, Proceedings of ICSE 08 19

20 Resulting CFG Taken from: G. Wassermann, Z. Su: Static Detection of Cross-Site Scripting Vulnerabilities, Proceedings of ICSE 08 20

21 Policy check Policies Set of violation patterns Represented as FSM Based on norms + Gecko code review Browsers are permissive more attack vectors Check Symbolic string value violation pattern i.e., CFG FSM 21

22 Results Taken from: G. Wassermann, Z. Su: Static Detection of Cross-Site Scripting Vulnerabilities, Proceedings of ICSE 08 22

23 Thank you for your attention! Try it yourself on the WebGoat tutorial Ask us for the url and credentials! 23

Finding Vulnerabilities in Web Applications

Finding Vulnerabilities in Web Applications Christopher Kruegel, Technical University Vienna Evolving Networks, Evolving Threats The past few years have witnessed a significant increase in the number of