Detecting Logic Vulnerabilities in E-commerce Applications

Abstract

Abstract-E-commerce has become a thriving business model. With easy access to various tools and third-party cashiers, it is straightforward to create and launch e-commerce web applications. However, it remains difficult to create secure ones. While third-party cashiers help bridge the gap of trustiness between merchants and customers, the involvement of cashiers as a new party complicates logic flows of checkout processes. Even a small loophole in a checkout process may lead to financial loss of merchants, thus logic vulnerabilities pose serious threats to the security of e-commerce applications. Performing manual code reviews is challenging because of the diversity of logic flows and the sophistication of checkout processes. Consequently, it is important to develop automated detection techniques. This paper proposes the first static detection of logic vulnerabilities in e-commerce web applications. The main difficulty of automated detection is the lack of a general and precise notion of correct payment logic. Our key insight is that secure checkout processes share a common invariant: A checkout process is secure when it guarantees the integrity and authenticity of critical payment status (order ID, order total, merchant ID and currency). Our approach combines symbolic execution and taint analysis to detect violations of the invariant by tracking tainted payment status and analyzing critical logic flows among merchants, cashiers and users. We have implemented a symbolic execution framework for PHP. In our evaluation of 22 unique payment modules, our tool detected 12 logic vulnerabilities, 11 of which are new. We have also performed successful proof-ofconcept experiments on live websites to confirm our findings.

Attack Patterns for Black-Box Security Testing of Multi-Party Web Applications

“…Similar attacks have also been detected in CaaS-enabled scenarios [35], [32]. For instance, a vulnerability in osCommerce v2.3.1 that allowed an attacker to shop for free has been reported in [32]: the attacker controls a SP and obtains an account identifier from PayPal for paying herself; later on, she replays this value in a subsequent session with a vulnerable SP where she purchases a product by paying herself.…”

“…This shows how our technique can cover the kinds of attacks that were reported in literature. For instance, in [35], the authors mention that a logical vulnerability in the 2Checkout integration in osCommerce v2.3 enables an attacker to reuse the payment status values of the paid order to bypass payment for future orders (cf. #4 of Table I).…”

“…The aforementioned attacks have been discovered through a variety of domain-specific techniques with different levels of complexity, ranging from formal verification [23], white-box analysis [35], black-box testing [32], to manual testing [18]. In this paper, we pursue a different approach and propose an automatic black-box testing technique for security-critical MPWAs.…”

“…While MPWAs for SSO and CaaS scenarios received a considerable attention (see, e.g., [29], [34], [35], [37], [36], [39], [32]), there are several other security critical MPWAs that are in need of close scrutiny. For instance, websites often send security-sensitive URIs to their users via email for verification purposes.…”

FUSE: Finding File Upload Bugs via Penetration Testing

“…Several techniques have been used in attempts to detect taint-style vulnerabilities, including XSS and SQLI, via static analyses [43,49,63,65] or dynamic executions [29,53]. Conducting symbolic execution has also been explored for finding logic bugs [59,62] and generating attack exploits [26]. However, few research studies have addressed finding U(E)FU vulnerabilities [40].…”