Memento: A Framework for Hardening Web Applications

ABSTRACT We propose a generic framework called Memento for systematically hardening web applications. Memento models a web application's behavior using a deterministic finite automata (DFA), where each server-side script is a state, and state transitions are triggered by HTTP requests. We use this DFA to defend against cross-site request forgery (CSRF) and cross-site-scripting (XSS) attacks. The client web browser and the application server each maintain a view of the application state. XSS and CSRF attacks either create an interaction that does not conform to the interaction model or force the web applica-tion's view of the state to diverge from the user's view. Memento derives behavior models directly from the application, and limits all run-time interactions to the derived interaction models, flagging any state divergence as an attack. We implemented Memento for the Apache web server and evaluated it using 8 open source web applications. We created Memento instances for the 8 web applications and verified Memento's defense on 14 CSRF and 46 XSS attacks. Memento was able to detect all the attacks with zero false positives and a performance overhead of 28%. Memento does not require any modifications in the web applications it protects.

Download full-text


Available from: Steve Chapin, Aug 31, 2015
  • Source
    [Show abstract] [Hide abstract]
    ABSTRACT: Static code analysis is a class of techniques for inspecting the source code of a computer program without executing it. One specific use of static analysis is to automatically scan source code for potential security problems, reducing the need for manual code reviews. Many web applications written in PHP suffer from injection vulnerabilities, and static analysis makes it possible to track down these vulnerabilities before they are exposed on the web. In this thesis, we evaluate the current state of static analysis tools targeted at the security of PHP web applications. We define an objective benchmark consisting of both synthetic and real-world tests, that we use to examine the capabilities and performance of these tools. With this information, we determine if any of these tools are suited for use in a system that automatically checks the security of web applications, and rejects unsecure applications before they are deployed onto a web server.