Memento: A Framework for Hardening Web Applications


We propose a generic framework called Memento for systematically hardening web applications. Memento models a web application's behavior using a deterministic finite automata (DFA), where each server-side script is a state, and state transitions are triggered by HTTP requests. We use this DFA to defend against cross-site request forgery (CSRF) and cross-site-scripting (XSS) attacks. The client web browser and the application server each maintain a view of the application state. XSS and CSRF attacks either create an interaction that does not conform to the interaction model or force the web applica-tion's view of the state to diverge from the user's view. Memento derives behavior models directly from the application, and limits all run-time interactions to the derived interaction models, flagging any state divergence as an attack. We implemented Memento for the Apache web server and evaluated it using 8 open source web applications. We created Memento instances for the 8 web applications and verified Memento's defense on 14 CSRF and 46 XSS attacks. Memento was able to detect all the attacks with zero false positives and a performance overhead of 28%. Memento does not require any modifications in the web applications it protects.

Download full-text


Available from: Steve Chapin
  • Source
    [Show abstract] [Hide abstract]
    ABSTRACT: Static code analysis is a class of techniques for inspecting the source code of a computer program without executing it. One specific use of static analysis is to automatically scan source code for potential security problems, reducing the need for manual code reviews. Many web applications written in PHP suffer from injection vulnerabilities, and static analysis makes it possible to track down these vulnerabilities before they are exposed on the web. In this thesis, we evaluate the current state of static analysis tools targeted at the security of PHP web applications. We define an objective benchmark consisting of both synthetic and real-world tests, that we use to examine the capabilities and performance of these tools. With this information, we determine if any of these tools are suited for use in a system that automatically checks the security of web applications, and rejects unsecure applications before they are deployed onto a web server.
    Preview · Article ·
  • Source
    [Show abstract] [Hide abstract]
    ABSTRACT: Cross Site Request Forgery (CSRF) allows an attacker to perform unauthorized activities without the knowledge of a user. An attack request takes advantage of the fact that a browser appends valid session information for each request. As a result, a browser is the first place to look for attack symptoms and take appropriate actions. Current browser-based detection methods are based on cross-origin policies that allow white listed third party websites to perform requests to a trusted website. These approaches are not effective if policies are specified incorrectly. Moreover, these approaches do not focus on the detection of stored CSRF attacks where attack payloads reside in trusted web pages. To alleviate these limitations, we present a CSRF attack detection mechanism for the client side. Our approach relies on the matching of parameters and values present in a suspected request with a form's input fields and values that are being displayed on a webpage (visibility). To overcome an attacker's attempt to circumvent form visibility checking, we compare the response content type of a suspected request with the expected content type. We have implemented a prototype plug-in tool for the Firefox browser and evaluated our approach on three real PHP programs vulnerable to CSRF attacks. We have also developed a benchmark test suite containing 134 test cases for emulating CSRF attack requests for the three programs. The evaluation results indicate that our approach can detect most of the common form of reflected and stored CSRF attacks. Moreover, our approach can stop attack requests that include subsets of visible form fields and values.
    Full-text · Conference Paper · Dec 2010