Defending Against Injection Attacks Through Context-Sensitive String Evaluation

Abstract

Abstract. Injection vulnerabilities pose a major threat to applicationlevel security. Some of the more common types are SQL injection, crosssite scripting and shell injection vulnerabilities. Existing methods for defending against injection attacks, that is, attacks exploiting these vulnerabilities, rely heavily on the application developers and are therefore error-prone. In this paper we introduce CSSE, a method to detect and prevent injection attacks. CSSE works by addressing the root cause why such attacks can succeed, namely the ad-hoc serialization of user-provided input. It provides a platform-enforced separation of channels, using a combination of assignment of metadata to user-provided input, metadata-preserving string operations and context-sensitive string evaluation. CSSE requires neither application developer interaction nor application source code modifications. Since only changes to the underlying platform are needed, it effectively shifts the burden of implementing countermeasures against injection attacks from the many application developers to the small team of security-savvy platform developers. Our method is effective against most types of injection attacks, and we show that it is also less error-prone than other solutions proposed so far. We have developed a prototype CSSE implementation for PHP, a platform that is particularly prone to these vulnerabilities. We used our prototype with phpBB, a well-known bulletin-board application, to validate our method. CSSE detected and prevented all the SQL injection attacks we could reproduce and incurred only reasonable run-time overhead.

A Metamodel for Web Application Injection Attacks and Countermeasures

“…The main means of attack Six out of the 12 gathered works [2,[11][12][13][14][15] involves classifying different types of WA injections.…”

“…All the studied works [2,[11][12][13][14][15] in one way or another discuss means of attack in terms of programming languages. This paper continues this tradition, using a categorization similar to that of [2].…”

“…Three out of 12 studied works discuss topics related to known and unknown WA injection vulnerabilities and exploits [11][12][13].…”

“…Pietraszek and Berghe [11] propose that the CVE (Common Vulnerabilities and Exposures) identification number should be included in the vulnerability information, if applicable. That is, the vulnerability can be known to the public at large.…”

“…The categorization used in this paper distinguish, as [11], between known and unknown vulnerabilities. A vulnerability known to the public at large is an easy target for an attacker as it often also has publicly known exploits, or at least ideas for how to conceive an exploit available.…”