Miracle-dz/UniFAR-FTUs huggingface dataset:
Remote Code Execution from SSTI in the Sandbox: Automatically Detecting and Exploiting Template Escape Bugs

Template engines are widely used in web applications to ease the development of user interfaces. The powerful capabilities provided by the template engines can be abused by attackers through server-side template injection (SSTI), enabling severe attacks on the server side, including remote code execution (RCE). Hence, modern template engines have provided a sandbox mode to prevent SSTI attacks from RCE. In this paper, we study an overlooked sandbox bypass vulnerability in template engines, called template escape, that could elevate SSTI attacks to RCE. By escaping the template rendering process, template escape bugs can be used to inject executable code on the server side. Template escape bugs are subtle to detect and exploit, due to their dependencies on the template syntax and the template rendering logic. Consequently, little knowledge is known about their prevalence and severity in the real world. To this end, we conduct the first in-depth study on template escape bugs and present TEF UZZ , an automatic tool to detect and exploit such bugs. By incorporating several new techniques, TEF UZZ does not need to learn the template syntax and can generate PoCs and exploits for the discovered bugs. We apply TEF UZZ to seven popular PHP template engines. In all, TEF UZZ discovers 135 new template escape bugs and synthesizes RCE exploits for 55 bugs. Our study shows that template escape bugs are prevalent and pose severe threats.
Rods with Laser Beams: Understanding Browser Fingerprinting on Phishing Pages

Phishing is one of the most common forms of social engineering attacks and is regularly used by criminals to compromise millions of accounts every year. Numerous solutions have been proposed to detect or prevent identity thefts, but phishers have responded by improving their methods and adopting more sophisticated techniques. One of the most recent advancements is the use of browser ﬁngerprinting. In particular, ﬁngerprinting techniques can be used as an additional piece of information that complements the stolen credentials This is conﬁrmed by the fact that credentials with ﬁngerprint data are sold for higher prices in underground markets. To understand the real extent of this phenomenon, we conducted the largest study of the phishing ecosystem in the topic by analyzing more than 1.7M recent phishing pages that emerged over the course of 21 months. In our systematic study, we performed detailed measurements to estimate the prevalence of ﬁngerprinting techniques in phishing pages. We found that more than one in four phishing pages adopt some form of ﬁngerprinting. This seems an ever growing trend as the percentage of pages using these techniques steadily increased during the analysis period (last month doubling what detected in the ﬁrst month).
TRust: A Compilation Framework for In-process Isolation to Protect Safe Rust against Untrusted Code

Rust was invented to help developers build highly safe systems. It comes with a variety of programming constructs that put emphasis on safety and control of memory layout. Rust enforces strict discipline about a type system and ownership model to enable compile-time checks of all spatial and temporal safety errors. Despite this advantage in security, the restrictions imposed by Rust’s type system make it difﬁcult or inefﬁcient to express certain designs or computations. To ease or simplify their programming, developers thus often include untrusted code from unsafe Rust or external libraries written in other languages. Sadly, the programming practices embracing such untrusted code for ﬂexibility or efﬁciency subvert the strong safety guarantees by safe Rust. This paper presents TR UST , a compilation framework which against untrusted code present in the program, provides trustworthy protection of safe Rust via in-process isolation. Its main strategy is allocating objects in an isolated memory region that is accessible to safe Rust but restricted from being written by the untrusted. To enforce this, TR UST employs software fault isolation and x86 protection keys. It can be applied directly to any Rust code without requiring manual changes. Our experiments reveal that TR UST is effective and efﬁcient, incurring runtime overhead of only 7.55% and memory overhead of 13.30% on average when running 11 widely used crates in Rust.
The OK Is Not Enough: A Large Scale Study of Consent Dialogs in Smartphone Applications

Mobile applications leaking personal information is a well established observation pre and post GDPR. The legal requirements for personal data collection in the context of tracking are specified by GDPR and the common understanding is, that tracking must be based on proper consent. Studies of the consent dialogs on websites revealed severe issues including dark patterns. However, the mobile space is currently under-explored with initial observations pointing towards a similar state of affairs. To address this research gap we analyze a subset of possible consent dialogs, namely privacy consent di-alogs, in 3006 Android and 1773 iOS applications. We show that 22.3% of all apps have any form of dialog with only 11.9% giving the user some form of actionable choice, e.g., at least an accept button. However, this choice is limited as a large proportion of all such dialogs employ some form of dark pattern coercing the user to consent.
MTSan: A Feasible and Practical Memory Sanitizer for Fuzzing COTS Binaries

Fuzzing has been widely adopted for finding vulnerabilities in programs, especially when source code is not available. But the effectiveness and efficiency of binary fuzzing are cur-tailed by the lack of memory (safety) sanitizers. This lack of binary sanitizers is due to the information loss in compiling programs and challenges in binary instrumentation. In this paper, we present a feasible and practical hardware-assisted memory sanitizer, MTSan, for binary fuzzing. MT-San can detect both spatial and temporal memory safety violations at runtime. It adopts a novel progressive object recovery scheme to recover objects in binaries, and uses a customized binary rewriting solution to instrument binaries with the memory-tagging-based memory safety sanitizing policy. Further, MTSan uses a hardware feature, ARM Memory Tagging Extension (MTE) to significantly reduce its runtime overhead. We implemented a prototype of MT-San on AArch64 and systematically evaluated its effectiveness and performance. Our evaluation results show that MT-San could detect more memory safety violations than existing binary sanitizers whiling introducing much lower run-time and memory overhead.
This paper is included in the Proceedings of the 32nd USENIX Security Symposium.

File System Access (FSA) API enables web applications to interact with ﬁles on the users’ local devices. Even though it can be used to develop rich web applications, it greatly extends the attack surface, which can be abused by adversaries to cause signiﬁcant harm. In this paper, for the ﬁrst time in the literature, we extensively study this new attack vector that can be used to develop a powerful new ransomware strain over a browser. Using the FSA API and WebAssembly technology, we demonstrate this novel browser-based ransomware called R Ø B as a malicious web application that encrypts the user’s ﬁles from the browser. We use R Ø B to perform impact analysis with different OSs, local directories, and antivirus solutions as well as to develop mitigation techniques against it. Our evaluations show that R Ø B can encrypt the victim’s local ﬁles including cloud-integrated directories, external storage devices, and network-shared folders regardless of the access limitations imposed by the API. Moreover, we evaluate and show how the existing defense solutions fall short against R Ø B in terms of their feasibility. We propose three potential defense solutions to mitigate this new attack vector. These solutions operate at different levels (i.e., browser-level, ﬁle-system-level, and user-level) and are orthogonal to each other. Our work strives to raise awareness of the dangers of R Ø B-like browser-based ransomware strains and shows that the emerging API documentation (i.e., the popular FSA) can be equivocal in terms of reﬂecting the extent of the threat
PATROL: Provable Defense against Adversarial Policy in Two-player Games

Recent advances in deep reinforcement learning (DRL) takes artificial intelligence to the next level, from making individual decisions to accomplishing sophisticated tasks via sequential decision makings, such as defeating world-class human players in various games and making real-time trading decisions in stock markets. Following these achievements, we have recently witnessed a new attack specifically designed against DRL. Recent research shows by learning and controlling an adversarial agent/policy, an attacker could quickly discover a victim agent’s weaknesses and thus force it to fail its task. Due to differences in the threat model, most existing defenses proposed for deep neural networks (DNN) cannot be migrated to train robust policies against adversarial policy attacks. In this work, we draw insights from classical game theory and propose the first provable defense against such attacks in two-player competitive games. Technically, we first model the robust policy training problem as finding the nash equilibrium (NE) point in the entire policy space. Then, we design a novel policy training method to search for the NE point in complicated DRL tasks. Finally, we theoretically prove that our proposed method could guarantee the lower-bound performance of the trained agents against arbitrary adversarial policy attacks. Through extensive evaluations, we demonstrate that our method significantly outperforms existing policy training methods in adversarial robustness and performance in non-adversarial settings.
FloatZone: Accelerating Memory Error Detection using the Floating Point Unit

Memory sanitizers are powerful tools to detect spatial and temporal memory errors, such as buffer overflows and use-after-frees. Fuzzers and software testers often rely on these tools to discover the presence of bugs. Sanitizers, however, incur significant runtime overhead. For example, Address-Sanitizer (ASan), the most widely used sanitizer, incurs a slowdown of 2x. The main source of this overhead consists of the sanitizer checks , which involve at least a memory lookup, a comparison, and a conditional branch instruction. Applying these checks to confirm the validity of the memory accesses in a program can greatly slow down the execution. We introduce FloatZone, a compiler-based sanitizer to detect spatial and temporal memory errors in C/C++ programs using lightweight checks that leverage the Floating Point Unit (FPU). We show that the combined effects of “lookup, compare, and branch” can be achieved with a single floating point addition that triggers an underflow exception in the case of a memory violation. This novel method to detect illegal accesses greatly improves performance by avoiding the drawbacks of traditional comparisons: it prevents branch mispredictions, enables higher instruction-level parallelism due to offloading to the FPU, and also reduces the cache miss rate due to the lack of shadow memory. Our evaluation shows that FloatZone significantly outperforms existing systems, with just 37% runtime overhead on SPEC CPU2006 and CPU2017. Moreover, we measure an average 2.87x increase in fuzzing throughput compared to the state of the art. Finally, we confirm that FloatZone offers detection capabilities comparable with ASan on
IPASIR-UP: User Propagators for CDCL

Modern SAT solvers are frequently embedded as sub-reasoning engines into more complex tools for addressing problems beyond the Boolean satisfiability problem. Examples include solvers for Satisfiability Modulo Theories (SMT), combinatorial optimization, model enumeration and counting. In such use cases, the SAT solver is often able to provide relevant information beyond the satisfiability answer. Further, domain knowledge of the embedding system (e.g., symmetry properties or theory axioms) can be beneficial for the CDCL search, but cannot be efficiently represented in clausal form. In this paper, we propose a general interface to inspect and influence the internal behaviour of CDCL SAT solvers. Our goal is to capture the most essential functionalities that are sufficient to simplify and improve use cases that require a more fine-grained interaction with the SAT solver than provided via the standard IPASIR interface. For our experiments, we extend CaDiCaL with our interface and evaluate it on two representative use cases: enumerating graphs within the SAT modulo Symmetries framework (SMS), and as the main CDCL(T) SAT engine of the SMT solver cvc5.
Reusable Enclaves for Confidential Serverless Computing

The recent development of Trusted Execution Environment has brought unprecedented opportunities for confidential computing within cloud-based systems. Among various popular cloud business models, serverless computing has gained dominance since its emergence, leading to a high demand for confidential serverless computing services based on trusted enclaves. However, the issue of cold start overhead significantly hinders its performance, as new enclaves need to be created to ensure a clean and verifiable execution environment. In this paper, we propose a novel approach for constructing reusable enclaves that enable rapid enclave reset and robust security with three key enabling techniques: enclave snapshot and rewinding , nested attestation , and multi-layer intra-enclave compartmentalisation . We have built a prototype system for confidential serverless computing, integrating OpenWhisk and a WebAssembly runtime, which significantly reduces the cold start overhead in an end-to-end serverless setting while imposing a reasonable performance impact on standard execution.
A Hybrid Alias Analysis and Its Application to Global Variable Protection in the Linux Kernel

Global variables in the Linux kernel have been a common target of memory corruption attacks to achieve privilege escalation. Several potential defense mechanisms can be employed to safeguard global variables. One approach involves placing global variables in read-only pages after kernel initialization ( ro_after_init ), while another involves employing software fault isolation (SFI) to dynamically block unintended writes to these variables. To deploy such solutions in practice, a key building block is a sound, precise, and scalable alias analysis that is capable of identifying all the pointer aliases of global variables, as any pointer alias may be used for intended writes to a global variable. Unfortunately, the two existing styles of data-flow-based ( e.g., Andersen-style) alias analysis and type-based alias analysis have serious limitations in scalability and precision when applied to the Linux kernel. This paper proposes a novel and general hybrid alias analysis that unifies the two complementary approaches in a graph reachability framework using context-free-language, also known as CFL-reachability. We show our hybrid alias analysis is extremely effective, significantly and simultaneously outperforming the data-flow-based alias analysis in scalability and the type-based alias analysis in precision. Under the same time budget, our hybrid analysis finds 42% of the Linux kernel global variables protectable as ro_after_init , whereas the two separate analyses find a combined 16% only.
SandDriller: A Fully-Automated Approach for Testing Language-Based JavaScript Sandboxes

Language-based isolation offers a cheap way to restrict the privileges of untrusted code. Previous work proposes a plethora of such techniques for isolating JavaScript code on the client-side, enabling the creation of web mashups. While these solutions are mostly out of fashion among practitioners, there is a growing trend to use analogous techniques for JavaScript code running outside of the browser, e.g., for protecting against supply chain attacks on the server-side. Irrespective of the use case, bugs in the implementation of language-based isolation can have devastating consequences. Hence, we propose S AND D RILLER , the ﬁrst dynamic analysis-based approach for detecting sandbox escape vulnerabilities. Our core insight is to design testing oracles based on two main objectives of language-based sandboxes: Prevent writes outside the sandbox and restrict access to privileged operations. Using instrumentation, we interpose oracle checks on all the references exchanged between the host and the guest code to detect foreign references that allow the guest code to escape the sandbox. If at run time, a foreign reference is detected by an oracle, S AND D RILLER proceeds to synthe-size an exploit for it. We apply our approach to six sandbox systems and ﬁnd eight unique zero-day sandbox breakout vulnerabilities and two crashes. We believe that S AND D RILLER can be integrated in the development process of sandboxes to detect security vulnerabilities in the pre-release phase.
Automated Analysis of Protocols that use Authenticated Encryption: How Subtle AEAD Differences can impact Protocol Security

Many modern security protocols such as TLS, WPA2, Wire-Guard, and Signal use a cryptographic primitive called Au-thenticated Encryption (optionally with Authenticated Data), also known as an AEAD scheme. AEAD is a variant of symmetric encryption that additionally provides authentication. While authentication may seem to be a straightforward additional requirement, it has in fact turned out to be complex: many different security notions for AEADs are still being proposed, and several recent protocol-level attacks exploit subtle behaviors that differ among real-world AEAD schemes. We provide the first automated analysis method for protocols that use AEADs that can systematically find attacks that exploit the subtleties of the specific type of AEAD used. This can then be used to analyze specific protocols with a fixed AEAD choice, or to provide guidance on which AEADs might be (in)sufficient to make a protocol design secure. We develop generic symbolic AEAD models, which we instantiate for the Tamarin prover. Our approach can automatically and efficiently discover protocol attacks that could previously only be found using manual inspection, such as the Salaman-der attack on Facebook’s message franking, and attacks on SFrame and YubiHSM. Furthermore, our analysis reveals undesirable behaviors of several other protocols.
Use of psychotherapy by rural and urban veterans.

PURPOSE To examine whether differences exist between rural and urban veterans in terms of initiation of psychotherapy, delay in time from diagnosis to treatment, and dose of psychotherapy sessions. METHODS Using a longitudinal cohort of veterans obtained from national Veterans Affairs databases (October 2003 through September 2004), we extracted veterans with a new diagnosis of depression, anxiety, or posttraumatic stress disorder (PTSD) (n = 410,923). Veterans were classified as rural (categories 6-9; n = 65,044) or urban (category 1; n = 149,747), using the US Department of Agriculture Rural-Urban Continuum Codes. Psychotherapy encounters were identified using Current Procedural Terminology codes for the 12 months following patients' initial diagnosis. FINDINGS Newly diagnosed rural veterans were significantly less likely (P < .0001) to receive psychotherapy (both individual and group). Urban veterans were roughly twice as likely as rural veterans to receive 4 or more (9.46% vs 5.08%) and 8 or more (5.59% vs 2.35%) psychotherapy sessions (P < .001). CONCLUSIONS Rural veterans are significantly less likely to receive psychotherapy services, and the dose of the psychotherapy services provided for rural veterans is limited relative to their urban counterparts. Focused efforts are needed to increase access to psychotherapy services provided to rural veterans with depression, anxiety, and PTSD.
Prioritizing land for conservation purposes in East Maui, Hawai'i

Hawai'i has 25% of the United States' federally listed endangered species and nearly 75% of the nation's recorded extinctions. Although no such list or datasets exists for cultural and historical landmarks, these resources may be similarly threatened. Of the eight major Hawaiian Islands, Maui is the second largest and has the third largest population. The average number of daily visitors has increased 333% to 51,222 people from 1980 to 2007. The history of grazing and agriculture along with increasing resident and tourist populations has placed pressure on Maui's resources. East Maui is the least developed part of the island and may be in a critical time period before becoming over-developed. Therefore, this study seeks to identify the parcels with the most relevant and important resources in and for the region today. Using primarily local interviews and historical data, I developed a conservation dataset linked to the region's tax parcels. The data were categorized into five resource groups: biological, recreational, cultural, historical and other. With the creation of a GIS-based tool, these categories can be given user-defined weights to highlight different conservation priorities. This will function as a decision support tool that will allow the land trust to explore different protection scenarios. This data, tool and document should provide a framework from which the land trust can base future conservation decisions regarding East Maui. I conducted eight different scenarios and selected parcels with the highest values, or greatest conservation importance. These parcels were compared across the scenarios. These analyses highlighted that historical resources are relatively under-protected, that many resources are concentrated in a limited number of parcels, and that many top parcels are proximate to county-designated growth boundaries. These results should incentivize the conservation community; protecting a few parcels can save a significant number of resources and that action should be taken soon before development is proposed.
Evaluation of cane and spur pruning effect on Traminette crop yield and fruit composition

Public Abstract: Traminette, a white-berried, French-American hybrid winegrape cultivar, is widely planted throughout the eastern US. Despite its popularity, relatively few formal field research studies have been conducted on Traminette. Traminette is known for bearing a relatively light crop but producing ample vegetative growth. There is thus a need to evaluate methods to improve Traminette crop yield in Southeastern US vineyards through novel practices. A pruning trial was conducted in a commercial vineyard in Hendersonville, NC. Spur pruning density was set by dormant pruning to 20 buds per vine (10, two-bud spurs). Canes were trained bilaterally (two canes per vine) and were pruned to one of the following methods: 1) two, 10-bud canes (20 total buds per vine); 2) two, eight-bud canes (16 total buds per vine); or, 3) two, five-bud canes (10 total buds per vine). Results indicated that pruning treatment had no effect on shoot number, cluster number, or crop yield per bud. Pruning further did not affect primary chemistry (sugar, pH, or titratable acidity) of the fruit juice collected at harvest. These results suggest that spur and cane pruning similarly impact Traminette productivity, regardless of bud number retained per cane or vine.