Nemesis: Preventing Authentication & [and] Access Control Vulnerabilities in Web Applications
This paper presents Nemesis, a novel methodology for mitigating authentication bypass and access control vulnerabilities in existing web applications. Authentication attacks occur when a web application authenticates users unsafely, granting access to web clients that lack the appropriate crede...
| Main Authors: | , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | en_US |
| Published: |
USENIX Association
2011
|
| Online Access: | http://hdl.handle.net/1721.1/62182 https://orcid.org/0000-0003-0238-2703 |
| _version_ | 1826202444289277952 |
|---|---|
| author | Dalton, Michael Kozyrakis, Christos Zeldovich, Nickolai |
| author2 | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory |
| author_facet | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Dalton, Michael Kozyrakis, Christos Zeldovich, Nickolai |
| author_sort | Dalton, Michael |
| collection | MIT |
| description | This paper presents Nemesis, a novel methodology for
mitigating authentication bypass and access control vulnerabilities
in existing web applications. Authentication
attacks occur when a web application authenticates users
unsafely, granting access to web clients that lack the appropriate
credentials. Access control attacks occur when
an access control check in the web application is incorrect
or missing, allowing users unauthorized access to
privileged resources such as databases and files. Such
attacks are becoming increasingly common, and have occurred
in many high-profile applications, such as IIS [10]
and WordPress [31], as well as 14% of surveyed web
sites [30]. Nevertheless, none of the currently available
tools can fully mitigate these attacks.
Nemesis automatically determines when an application
safely and correctly authenticates users, by using Dynamic
Information Flow Tracking (DIFT) techniques to
track the flow of user credentials through the application’s
language runtime. Nemesis combines authentication information
with programmer-supplied access control rules
on files and database entries to automatically ensure that
only properly authenticated users are granted access to
any privileged resources or data. A study of seven popular
web applications demonstrates that a prototype of
Nemesis is effective at mitigating attacks, requires little
programmer effort, and imposes minimal runtime overhead.
Finally, we show that Nemesis can also improve the
precision of existing security tools, such as DIFT analyses
for SQL injection prevention, by providing runtime
information about user authentication. |
| first_indexed | 2024-09-23T12:07:33Z |
| format | Article |
| id | mit-1721.1/62182 |
| institution | Massachusetts Institute of Technology |
| language | en_US |
| last_indexed | 2024-09-23T12:07:33Z |
| publishDate | 2011 |
| publisher | USENIX Association |
| record_format | dspace |
| spelling | mit-1721.1/621822022-10-01T08:20:44Z Nemesis: Preventing Authentication & [and] Access Control Vulnerabilities in Web Applications Dalton, Michael Kozyrakis, Christos Zeldovich, Nickolai Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Zeldovich, Nickolai Zeldovich, Nickolai This paper presents Nemesis, a novel methodology for mitigating authentication bypass and access control vulnerabilities in existing web applications. Authentication attacks occur when a web application authenticates users unsafely, granting access to web clients that lack the appropriate credentials. Access control attacks occur when an access control check in the web application is incorrect or missing, allowing users unauthorized access to privileged resources such as databases and files. Such attacks are becoming increasingly common, and have occurred in many high-profile applications, such as IIS [10] and WordPress [31], as well as 14% of surveyed web sites [30]. Nevertheless, none of the currently available tools can fully mitigate these attacks. Nemesis automatically determines when an application safely and correctly authenticates users, by using Dynamic Information Flow Tracking (DIFT) techniques to track the flow of user credentials through the application’s language runtime. Nemesis combines authentication information with programmer-supplied access control rules on files and database entries to automatically ensure that only properly authenticated users are granted access to any privileged resources or data. A study of seven popular web applications demonstrates that a prototype of Nemesis is effective at mitigating attacks, requires little programmer effort, and imposes minimal runtime overhead. Finally, we show that Nemesis can also improve the precision of existing security tools, such as DIFT analyses for SQL injection prevention, by providing runtime information about user authentication. National Science Foundation (U.S.) (Award 0546060) (Award 0701607) 2011-04-08T20:19:24Z 2011-04-08T20:19:24Z 2009-08 Article http://purl.org/eprint/type/ConferencePaper http://hdl.handle.net/1721.1/62182 Dalton, Michael, Christos Kozyrakis, and Nickolai Zeldovich. "Nemesis: Preventing Authentication & Access Control Vulnerabilities in Web Applications" USENIX UNIX Security Symposium, 2009. https://orcid.org/0000-0003-0238-2703 en_US http://www.usenix.org/events/sec09/tech/full_papers/dalton.pdf USENIX UNIX Security Symposium Creative Commons Attribution-Noncommercial-Share Alike 3.0 http://creativecommons.org/licenses/by-nc-sa/3.0/ application/pdf USENIX Association MIT web domain |
| spellingShingle | Dalton, Michael Kozyrakis, Christos Zeldovich, Nickolai Nemesis: Preventing Authentication & [and] Access Control Vulnerabilities in Web Applications |
| title | Nemesis: Preventing Authentication & [and] Access Control Vulnerabilities in Web Applications |
| title_full | Nemesis: Preventing Authentication & [and] Access Control Vulnerabilities in Web Applications |
| title_fullStr | Nemesis: Preventing Authentication & [and] Access Control Vulnerabilities in Web Applications |
| title_full_unstemmed | Nemesis: Preventing Authentication & [and] Access Control Vulnerabilities in Web Applications |
| title_short | Nemesis: Preventing Authentication & [and] Access Control Vulnerabilities in Web Applications |
| title_sort | nemesis preventing authentication and access control vulnerabilities in web applications |
| url | http://hdl.handle.net/1721.1/62182 https://orcid.org/0000-0003-0238-2703 |
| work_keys_str_mv | AT daltonmichael nemesispreventingauthenticationandaccesscontrolvulnerabilitiesinwebapplications AT kozyrakischristos nemesispreventingauthenticationandaccesscontrolvulnerabilitiesinwebapplications AT zeldovichnickolai nemesispreventingauthenticationandaccesscontrolvulnerabilitiesinwebapplications |