一句话：提出Artemis，用LLM辅助的跨过程路径敏感污点分析检测PHP应用SSRF漏洞，显著降低误报并发现新CVE。
PHP Web 应用中的 SSRF 漏洞难以检测，现有静态工具缺少 SSRF 特征且未考虑 PHP 动态类型。本文提出 Artemis：提取 PHP 内置与第三方函数作为候选 source/sink，构建显式与隐式调用图，执行避免过度污染并在不可利用时暂停的污点分析，最后检查路径条件兼容性以剪枝误报。在 250 个 PHP 应用上，Artemis 报告 207 条真实漏洞路径（106 个真实 SSRF）和 15 个误报；其中 35 个为首次发现，24 个获确认并分配 CVE。
Server-side request forgery (SSRF) vulnerabilities are inevitable in PHP web applications. Existing static tools in detecting vulnerabilities in PHP web applications neither contain SSRF-related features to enhance detection accuracy nor consider PHP’s dynamic type features. In this paper, we present Artemis , a static taint analysis tool for detecting SSRF vulnerabilities in PHP web applications. First, Artemis extracts both PHP built-in and third-party functions as candidate source and sink functions. Second, Artemis constructs both explicit and implicit call graphs to infer functions’ relationships. Third, Artemis performs taint analysis based on a set of rules that prevent over-tainting and pauses when SSRF exploitation is impossible. Fourth, Artemis analyzes the compatibility of path conditions to prune false positives. We have implemented a prototype of Artemis and evaluated it on 250 PHP web applications. Artemis reports 207 true vulnerable paths (106 true SSRFs) with 15 false positives. Of the 106 detected SSRFs, 35 are newly found and reported to developers, with 24 confirmed and assigned CVE IDs.
@article{paperbot3176,
title = {Artemis: Toward Accurate Detection of Server-Side Request Forgeries through LLM-Assisted Inter-procedural Path-Sensitive Taint Analysis},
author = {Yuchen Ji and Ting Dai and Zhichao Zhou and Yutian Tang and Jingzhu He},
journal = {Proceedings of the ACM on Programming Languages},
volume = {9},
number = {OOPSLA1},
year = {2025},
doi = {10.1145/3720488}
}