Abstract-Remote code execution (RCE) attacks are one of the most prominent security threats for web applications. It is a special kind of cross-site-scripting (XSS) attack that allows client inputs to be stored and executed as server side scripts. RCE attacks often require coordination of multiple requests and manipulation of string and non-string inputs from the client side to nullify the access control protocol and induce unusual execution paths on the server side. We propose a path-and contextsensitive interprocedural analysis to detect RCE vulnerabilities. The analysis features a novel way of analyzing both the string and non-string behavior of a web application in a path sensitive fashion. It thoroughly handles the practical challenges entailed by modeling RCE attacks. We develop a prototype system and evaluate it on ten real-world PHP applications. We have identified 21 true RCE vulnerabilities, with 8 unreported before.
Zheng et al. REF proposed a path-sensitive static analysis of PHP web applications for security vulnerability detection.
Path sensitive static analysis of web applications for remote code execution vulnerability detection
2013 35th International Conference on Software Engineering (ICSE)
2013 35th International Conference on Software Engineering (ICSE)
Computer Science