# A Vulnerability Scanning Method for Web Services in Embedded Firmware
## 3 Background and Motivation
### Motivating Example  
Firmware in embedded devices are user-oriented, and to facilitate access to operating system features and hardware functionality, most embedded devices offer a web interface that allows users to configure and manage the device. These web interfaces are often the primary vectors for attacks on embedded devices. Typically, a web interface consists of front-end pages, back-end files, and middleware components. The front-end files construct a complete web page, are displayed to the user via a browser, and offer an interactive interface for device operation. Back-end files handle web requests originating from the front end, communicating with the front-end pages to deliver the full functionality of the web application. Middleware refers to a layer of software that resides between the front-end pages and back-end files; it processes web requests and responses, enabling the functionalities of the web interface. The web services of IoT devices comprise two main components: the front end and the back end. The front end presents the device's configuration options and functionalities to the end user, and the back end parses requests from the front end and carries out corresponding services. Figure 1 illustrates an example wherein a user employs an interactive web interface to rapidly configure the Wi-Fi settings of a router. The user interacts with the front-end interface, automatically generating a request containing the \"_timeZone_\" field and sending it to the back end. Upon receiving this request, the back-end web server parses it and invokes the function \"_form_fast_setting_wifi_set_\" to process the request. The function \"_form_fast_setting_wifi_set_\" retrieves the value corresponding to the \"_timeZone_\" field on line 4, and on line 11, it formats this value as an argument for the \"_isoc99_sscant_\" function, which is then utilized in subsequent parts of the program. Regrettably, the web service contains a classic stack overflow vulnerability. The initial stack overflow is on line 11, where the function \"_form_fast_setting_wifi_set_\" fails to check the length of the \"_timeZone_\" field before utilizing it as an argument in the \"_isoc99_sscant_\" for formatted input. This oversight results in stack overflow during the formatting of input into the variable list (the third and fourth arguments). Consequently, an attacker could induce a system crash or exploit the vulnerability further by sending a specially crafted data packet to trigger this stack overflow. **The relationship between the front end and the back end. ** Back-end binaries processing user input exhibit evident characteristics associated with HTTP services manifested by using keywords related to front-end files. As illustrated in Figure 1 with the example \"_timeZone_\", user inputs are labeled as keywords on the front end and encoded within the data packet. The back end then uses the same or similar keywords to extract user input from the data packet. Data are commonly transmitted in a key-value format. In addition to retrieving keywords for incoming front-end data--whether as request body parameters or  
Figure 1: Motivating example. On the left is the web source code related to the WiFi configuration for a certain router’s front end, and on the right is the back-end code for message processing. The timeZone string is used by both front-end and back-end code, and attackers can send carefully crafted timeZone values to trigger a buffer overflow. HTTP header parameters--the back-end binary files also output page information, which can be leveraged to extract characteristic words. **Boundary binary. ** Firmware encompasses numerous binary programs; however, the subset specifically responsible for processing web service data, referred to as \"boundary binary programs\", could be more sparse. These boundary binary programs are primarily tasked with processing web service data, which necessitates logic for handling requests from external sources.