一句话：提出浏览器安全策略模糊测试工具 CorbFuzz，借助策略预言机检测 CORB 及同类策略的实现缺陷。
浏览器通过安全策略拦截恶意行为，例如用于防御 Spectre 等侧信道攻击的跨源读取阻塞（CORB）。由于浏览器实现策略时只能看到 HTTP 请求与响应并据此做出策略动作，要判断其行为是否符合预期并不容易。本文提出 CorbFuzz，一种面向浏览器安全策略的模糊测试工具：它引入策略预言机，跟踪 Web 应用行为并根据应用状态推断期望的策略动作，再与浏览器实际行为比对，从而发现策略弱点。为提升覆盖率与自动化程度，CorbFuzz 在模糊测试一组 Web 应用时对状态相关查询进行符号化求值，并从数据库查询与分支条件中收集类型信息，避免生成不一致的数据值。作者在 Chromium 与 WebKit 的 CORB 实现以及 Firefox 的 Opaque Response Blocking（ORB）实现上，用从 GitHub 收集的 Web 应用进行了评估，并在 Chromium 的 CORB 实现中发现了三类缺陷。
Browsers use security policies to block malicious behaviors. Cross-Origin Read Blocking (CORB) is a browser security policy for preventing side-channel attacks such as Spectre. We propose a web browser security policy fuzzer called CorbFuzz for checking CORB and similar policies. In implementing a security policy, the browser only has access to HTTP requests and responses, and takes policy actions based solely on those interactions. In checking the browser security policies, CorbFuzz uses a policy oracle that tracks the web application behavior and infers the desired policy action based on the web application state. By comparing the policy oracle with the browser behavior, CorbFuzz detects weaknesses in browser security policies. CorbFuzz checks the web browser policy by fuzzing a set of web applications where the state-related queries are symbolically evaluated for increased coverage and automation. CorbFuzz collects type information from database queries and branch conditions in order to prevent the generation of inconsistent data values during fuzzing. We evaluated CorbFuzz on CORB implementations of Chromium and Webkit, and Opaque Response Blocking (ORB) policy implementation of Firefox using web applications collected from GitHub. We found three classes of weaknesses in Chromium’s implementation of CORB.
DOI 原文 ·
@inproceedings{paperbot6502,
title = {CorbFuzz: Checking Browser Security Policies with Fuzzing},
author = {Chaofan Shou and Ismet Burak Kadron and Qi Su and Tevfik Bultan},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678636}
}