UChecker: Automatically Detecting PHP-Based Unrestricted File Upload Vulnerabilities

Jin Huang; Yu Li; Junjie Zhang; Rui Dai

doi:10.1109/DSN.2019.00064

UChecker: Automatically Detecting PHP-Based Unrestricted File Upload Vulnerabilities

Jin Huang, Yu Li, Junjie Zhang, Rui Dai

Computer Science and Engineering

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

Unrestricted file upload vulnerabilities enable attackers to upload and execute malicious scripts in web servers. We have built a system, namely UChecker, to effectively and automatically detect such vulnerabilities in PHP server-side web applications. Towards this end, UChecker first interprets abstract syntax trees (AST) of program source code to perform symbolic execution. It then models vulnerabilities using SMT constraints and further leverages an SMT solver to verify the satisfiability of these constraints. UChecker features a novel vulnerability-oriented locality analysis algorithm to reduce the workload of symbolic execution, an AST-driven symbolic execution engine with compact data structures, and rules to translate PHP-based constraints into SMT-based constraints by mitigating their semantic gaps. Experiments based on real-world examples have demonstrated that UChecker has accomplished a high detection accuracy. In addition, it detected three vulnerable PHP scripts that are previously unknown.

Original language	English
Title of host publication	2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
Publisher	IEEE
Pages	581-592
Number of pages	12
ISBN (Electronic)	978-1-7281-0057-9, 978-1-7281-0056-2
ISBN (Print)	978-1-7281-0058-6
DOIs	https://doi.org/10.1109/DSN.2019.00064
State	Published - Aug 22 2019
Event	49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2019 - Portland, United States Duration: Jun 24 2019 → Jun 27 2019

Conference

Conference	49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2019
Country/Territory	United States
City	Portland
Period	6/24/19 → 6/27/19

ASJC Scopus Subject Areas

Computer Networks and Communications
Safety, Risk, Reliability and Quality
Hardware and Architecture

Keywords

detection
program analysis
symbolic execution
vulnerability
web security
Servers
Arrays
Syntactics
Semantics
Indexes
Analytical models
Web Application

Disciplines

Computer Sciences
Engineering

Access to Document

10.1109/DSN.2019.00064License: Unspecified

Cite this

Huang, J, Li, Y, Zhang, J & Dai, R 2019, UChecker: Automatically Detecting PHP-Based Unrestricted File Upload Vulnerabilities. in 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)., 8809518, IEEE, pp. 581-592, 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2019, Portland, United States, 6/24/19. https://doi.org/10.1109/DSN.2019.00064

@inproceedings{32d169790eb647c4b194a1901bb3275c,

title = "UChecker: Automatically Detecting PHP-Based Unrestricted File Upload Vulnerabilities",

abstract = " Unrestricted file upload vulnerabilities enable attackers to upload and execute malicious scripts in web servers. We have built a system, namely UChecker, to effectively and automatically detect such vulnerabilities in PHP server-side web applications. Towards this end, UChecker first interprets abstract syntax trees (AST) of program source code to perform symbolic execution. It then models vulnerabilities using SMT constraints and further leverages an SMT solver to verify the satisfiability of these constraints. UChecker features a novel vulnerability-oriented locality analysis algorithm to reduce the workload of symbolic execution, an AST-driven symbolic execution engine with compact data structures, and rules to translate PHP-based constraints into SMT-based constraints by mitigating their semantic gaps. Experiments based on real-world examples have demonstrated that UChecker has accomplished a high detection accuracy. In addition, it detected three vulnerable PHP scripts that are previously unknown.",

keywords = "detection, program analysis, symbolic execution, vulnerability, web security, Servers, Arrays, Syntactics, Semantics, Indexes, Analytical models, Web Application",

author = "Jin Huang and Yu Li and Junjie Zhang and Rui Dai",

note = "Publisher Copyright: {\textcopyright} 2019 IEEE.; 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2019 ; Conference date: 24-06-2019 Through 27-06-2019",

year = "2019",

month = aug,

day = "22",

doi = "10.1109/DSN.2019.00064",

language = "English",

isbn = "978-1-7281-0058-6",

pages = "581--592",

booktitle = "2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)",

publisher = "IEEE",

}

TY - GEN

T1 - UChecker

T2 - 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2019

AU - Huang, Jin

AU - Li, Yu

AU - Zhang, Junjie

AU - Dai, Rui

PY - 2019/8/22

Y1 - 2019/8/22

N2 - Unrestricted file upload vulnerabilities enable attackers to upload and execute malicious scripts in web servers. We have built a system, namely UChecker, to effectively and automatically detect such vulnerabilities in PHP server-side web applications. Towards this end, UChecker first interprets abstract syntax trees (AST) of program source code to perform symbolic execution. It then models vulnerabilities using SMT constraints and further leverages an SMT solver to verify the satisfiability of these constraints. UChecker features a novel vulnerability-oriented locality analysis algorithm to reduce the workload of symbolic execution, an AST-driven symbolic execution engine with compact data structures, and rules to translate PHP-based constraints into SMT-based constraints by mitigating their semantic gaps. Experiments based on real-world examples have demonstrated that UChecker has accomplished a high detection accuracy. In addition, it detected three vulnerable PHP scripts that are previously unknown.

AB - Unrestricted file upload vulnerabilities enable attackers to upload and execute malicious scripts in web servers. We have built a system, namely UChecker, to effectively and automatically detect such vulnerabilities in PHP server-side web applications. Towards this end, UChecker first interprets abstract syntax trees (AST) of program source code to perform symbolic execution. It then models vulnerabilities using SMT constraints and further leverages an SMT solver to verify the satisfiability of these constraints. UChecker features a novel vulnerability-oriented locality analysis algorithm to reduce the workload of symbolic execution, an AST-driven symbolic execution engine with compact data structures, and rules to translate PHP-based constraints into SMT-based constraints by mitigating their semantic gaps. Experiments based on real-world examples have demonstrated that UChecker has accomplished a high detection accuracy. In addition, it detected three vulnerable PHP scripts that are previously unknown.

KW - detection

KW - program analysis

KW - symbolic execution

KW - vulnerability

KW - web security

KW - Servers

KW - Arrays

KW - Syntactics

KW - Semantics

KW - Indexes

KW - Analytical models

KW - Web Application

UR - http://www.scopus.com/inward/record.url?scp=85070861926&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85070861926&partnerID=8YFLogxK

UR - https://corescholar.libraries.wright.edu/cse/521

U2 - 10.1109/DSN.2019.00064

DO - 10.1109/DSN.2019.00064

M3 - Conference contribution

SN - 978-1-7281-0058-6

SP - 581

EP - 592

BT - 2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)

PB - IEEE

Y2 - 24 June 2019 through 27 June 2019

ER -

UChecker: Automatically Detecting PHP-Based Unrestricted File Upload Vulnerabilities

Abstract

Conference

ASJC Scopus Subject Areas

Keywords

Disciplines

Access to Document

Other files and links

Cite this