DjangoChecker: Applying extended taint tracking and server side parsing for detection of context‐sensitive XSS flaws. (23rd October 2018)

• Record Type: Journal Article
• Authors: Steinhauser, Antonín; Tůma, Petr
• Is Part Of: Software, practice & experience. Volume 49:Number 1(2019)
• Page Start: 130
• Page End: 148
• Publication Date: 2018-10-23
• Subjects: context‐sensitive XSS -- security -- web application; Computer software -- Periodicals; Computer programming -- Periodicals; Computer programs -- Periodicals; 005.3
• DOI: 10.1002/spe.2649
• Languages: English
• ISSNs: 0038-0644

Abstract

Summary: Cross‐site scripting (XSS) flaws are a class of security flaws that permit the injection of malicious code into a web application. In simple situations, these flaws can be caused by missing input sanitizations. Sometimes, however, all application inputs are sanitized, but the sanitizations are not appropriate for the browser contexts of the sanitized values. Using an incorrect sanitizer can make the application look protected, when it is in fact vulnerable as if no sanitization was used, creating a context‐sensitive XSS flaw. To discover context‐sensitive XSS flaws, we introduce DjangoChecker. DjangoChecker combines extended dynamic taint tracking with a model browser for context analysis. We demonstrate the practical application of DjangoChecker on eight mature web applications based on Django, discovering previously unknown flaws in seven of the eight applications, including highly severe flaws that allow arbitrary JavaScript execution in the seven flawed applications.