FlowWatcher: Defending against Data Disclosure Vulnerabilities in Web Applications

摘要: Bugs in the authorisation logic of web applications can expose data one user to another. Such disclosure vulnerabilities are common---they be caused by a single omitted access control check application. We make observation that, while implementation is complex and therefore error-prone, most only use simple models, which each piece accessible or group users. This makes it possible validate correct operation externally, based on observed HTTP traffic from an describe FlowWatcher, proxy that mitigates unmodified applications. FlowWatcher monitors shadows part application's state rule-based specification user-data-access (UDA) policy. The UDA policy states intended ownership how changes requests. detects violations tracking items likely unique across requests responses different evaluate prototype as plug-in for Nginx reverse show with short policies, mitigate CVE bugs six~popular