Automated detection of parameter tampering opportunities and vulnerabilities in web applications

Abstract

Parameter tampering attacks are dangerous to a web application whose server fails to replicate the validation of user-supplied data that is performed by the client in web forms. Malicious users who circumvent the client can capitalize on the missing server validation. In this paper, we provide a formal description of parameter tampering vulnerabilities and a high level approach for their detection. We specialize this high level approach to develop complementary detection solutions in two interesting settings: blackbox (only analyze client-side code in web forms) and whitebox (also analyze server-side code that processes submitted web forms). This paper presents interesting challenges encountered in realizing the high level approach for each setting and novel technical contributions that address these challenges. We also contrast utility, difficulties and effectiveness issues in both settings and provide a quantitative comparison of results. Our experiments with real world and open source applications demonstrate that parameter tampering vulnerabilities are prolific (total 47 in 9 applications), and their exploitation can have serious consequences including unauthorized transactions, account hijacking and financial losses. We conclude this paper with a discussion on countermeasures for parameter tampering attacks and present a detailed survey of existing defenses and their suitability.

Detecting Logic Vulnerabilities in E-commerce Applications

“…Third, to detect deviations of normal workflows, it is important to first establish a good guideline of correct workflows. Such a guideline can be specified by developers [19], inferred from client-side validations which should be replicated on the server side [4,17], or obtained from dynamic analyses [3,11,15,22]. An alternative way of thwarting logic attacks is secure-byconstruction.…”

“…It is a common attack vector for various vulnerabilities which include logic vulnerabilities. WAPTEC [5] takes a white-box approach that combines symbolic execution and dynamic analysis to detect parameter tampering vulnerabilities in PHP applications, while NoTamper [4] and PAPAS [2] adopt black-box based approaches. NoTamper [4] detects insufficient server-side validations where a server fails to replicate the validations on the client side.…”

“…WAPTEC [5] takes a white-box approach that combines symbolic execution and dynamic analysis to detect parameter tampering vulnerabilities in PHP applications, while NoTamper [4] and PAPAS [2] adopt black-box based approaches. NoTamper [4] detects insufficient server-side validations where a server fails to replicate the validations on the client side. PAPAS [2] aims at automated discovery of parameter pollution based on a black-box scanning technique for vulnerable parameters.…”

Lom: Discovering logic flaws within MongoDB-based web applications

“…For example, Doupé et al [8] and NoTamper [9] can address EAR vulnerability and parameter tampering respectively. In comparison, our approaches can cover not only these two attacks, but also forceful browsing attack.…”

Attack Patterns for Black-Box Security Testing of Multi-Party Web Applications

“…Prithvi et al [27] proposes a black-box technique for exposing vulnerabilities in the server-side logic of web applications by identifying various parameter tampering opportunities and by generating test cases corresponding to the identified opportunity. However, this technique required manual effort to convert these exploit opportunities to actual ones.…”