Securing Web applications

Web application vulnerabilities have become a major concern in software security. We will present major attack patterns, i.e. SQL injection, cross-site scripting, cross-site request forgery, JavaScript hijacking, and DNS rebinding, together with a survey and assessment of the countermeasures available to web application developers. a 2008 Elsevier Ltd. All rights reserved. The World Wide Web has become a popular platform for a wide rage of services that provide on-line access to their customer base. This platform has been built by adding ever more sophisticated software layers on top of the communications infrastructure provided by the Internet. Vulnerabilities in these software layers are accounting for an increasing number of reported vulnerabilities and real attacks. Attacks have stolen contact data from Gmail users; a worm had spread to over a million users on MySpace. Cross-site scripting (XSS) came in at number one in the 2007 OWASP Top Ten vulnerabilities. An analysis of the Common Vulnerabilities and Exposures list found that in 2005 XSS overtook buffer overruns as the number one software vulnerability, and in 2006 SQL injection ranked second. When securing web applications you rarely have to deal with low level memory management issues typical for buffer overrun vulnerabilities, but with the platform provided by current web technologies. At this level, vulnerabilities fall into three main categories: Inadequate handling of malicious inputs; Naı̈ve execution models; and Circumvention of the same origin policy. 006/01/advanced-web-att ite_Scripting_Worm_Hits _Top_Ten_Project. lity typedistributions inCV er Ltd. All rights reserved 1. Web applications We will briefly introduce the computing paradigm that underlies web applications to provide the foundations for a discussion of their vulnerabilities. This discussion will put a stronger emphasis on general principles than on the idiosyncrasies of individual browsers. Diversity is supposedly good for security, and there is indeed diversity between browsers from different vendors and also between different versions of the same product. Developers of web applications thus cannot rely on all clients to provide exactly the same defence mechanisms. The business logic of a web application is implemented at a web server and a backend server, and advertised by an URL (Uniform Resource Locator). The web server is known by its domain name. The main infrastructure component on the client side is the browser, which has no name other than the client’s IP address. Browser and server communicate via a transport protocol. A transport protocol defines data formats, but also algorithms for packaging and unpacking application payloads. Fig. 1 shows the basic information flow in a so-called Web 1.0 application. The transport protocol is HTTP, the data format is HTML (and Cascading Style Sheets (CSS)). The user calls ack-techniques-using.html. _MySpace/1129232391. E. http://cve.mitre.org/docs/vuln-trends/vuln-trends.pdf; May2007. . user Browser client side HTTP request HTML & CSS data Backend Server server side Web Server Fig. 1 – Web 1.0 application. Table 1 – Evaluating same origin for http://www.my.org/ dir1/hello.html