An Approach for the Automated Detection of XSS Vulnerabilities in Web Templates

Abstract

Web sites are exposed to various threats such as injections or denial of service attacks. Hence, the protection of the web site and the underlying system components is of major importance in order to deploy a reliable and secure web application. The task of securing a web application is quite complex. It requires the hardening of the system components and installation of security patches on a regular basis. Furthermore, the web application should be checked against vulnerabilities by using penetration testing methods. From a developer's point of view, security aspects should be considered in the early stage of web application's development life cycle already. Of special interest is the web template which is used to generate the user interface of the web page. This component connects the web application to the outside world. Hence, it is the main entrance point to inject malicious things into the web application. In this paper, we present an approach to check web templates against cross site scripting (XSS) attacks in an automatic manner. The basic idea is inspired by the LLVM compiler which uses an internal representation to optimize the machine code independently from the used programming language. Instead of searching for vulnerabilities selectively in the template code itself, the web template is converted into an internal representation. This representation decouples the structure of the web template from the syntax of the template engine. The internal representation is analysed with respect to exploitable parts. The results of the analysis are potentially vulnerable code snippets. These snippets are coded back into the template format and are used within unit tests to check whether they can be exploited with actual attack vectors. The advantage of our approach is its universality; it works with any kind of web template engine.

Untitled

“…Each security gap leads to expensive consequences and if it takes a long time to less trust in new technologies. To avoid this risk, the templates from the Preprocessing App were tested with the methods of Stigler et al (2018) to detect cross site scripting vulnerabilities in websites. All implemented templates are now guarded against cross site scripting attacks.…”

“…Figure 6 shows the web template to create new projects over the admin panel from the web application. All input fields are checked for cross site scripting vulnerabilities with the tests from Stigler et al (2018). The report shows that the Preprocessing App is protected against the most common security flaws.…”

Cross-site Scripting Research: A Review

“…They achieved 95% accuracy and 0.99% false-positive rate with their tool called CrawlerXSS.Jia-dong Liu and Yu-yi Ou[17] studied security software and analyzed web filtering rules. By using this analysis, proposed a method to detect XSS attacks based on vectors.Stigler, Karzhaubekova and Karg[18] proposed a method to detect XSS vulnerabilities in Web templates automatically. They parsed every template into internal representation (IR) and performed an XSS test on these IR, and generated unit tests based on parts of IR.…”