一句话：提出基于动态分析的方法自动发现客户端业务流篡改漏洞，在200个网站中识别出27个漏洞。
Web 应用的复杂性使业务逻辑暴露于攻击面：为协调商家、用户和第三方支付等多方，开发者常将部分逻辑放到客户端，而客户端代码可被实时篡改，导致业务逻辑扰动和财务损失。尽管“客户端不可信”是共识，但面对庞大且可能来自第三方的客户端代码，人工理解并定位漏洞仍极困难。本文研究客户端业务流篡改漏洞，提出基于动态分析的方法自动识别此类漏洞。作者在 200 个流行真实网站上评估，开销可忽略，并在 23 个网站发现 27 个独特漏洞，包括《纽约时报》、HBO 和 YouTube；攻击者可借此绕过付费墙、禁用广告拦截检测、非法赚取积分等。
The sheer complexity of web applications leaves open a large attack surface of business logic. Particularly, in some scenarios, developers have to expose a portion of the logic to the client-side in order to coordinate multiple parties (e.g. merchants, client users, and third-party payment services) involved in a business process. However, such client-side code can be tampered with on the fly, leading to business logic perturbations and financial loss. Although developers become familiar with concepts that the client should never be trusted, given the size and the complexity of the client-side code that may be even incorporated from third parties, it is extremely challenging to understand and pinpoint the vulnerability. To this end, we investigate client-side business flow tampering vulnerabilities and develop a dynamic analysis based approach to automatically identifying such vulnerabilities. We evaluate our technique on 200 popular real-world websites. With negligible overhead, we have successfully identified 27 unique vulnerabilities on 23 websites, such as New York Times, HBO, and YouTube, where an adversary can interrupt business logic to bypass paywalls, disable adblocker detection, earn reward points illicitly, etc.
DOI 原文 ·
@inproceedings{paperbot5564,
title = {Finding client-side business flow tampering vulnerabilities},
author = {I Luk Kim and Yunhui Zheng and Hogun Park and Weihang Wang and Wei You and Yousra Aafer and Xiangyu Zhang},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380355}
}