정적 오염 분석을 활용한 타입스크립트 코드의 보안 취약점 탐지
Detecting Security Vulnerabilities in TypeScript Code with Static Taint Analysis
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
자바스크립트로 작성된 웹 어플리케이션에서 Cross-Site Scripting (XSS), SQL Injection과 같은 검증되지 않은 사용자 입력 데이터로 인해 발생하는 취약점을 탐지하기 위해 오염 분석 기법이 널리 사용되고 있다. 이러한 취약점을 탐지하기 위해서는 사용자 입력 데이터에 영향을 받는 변수들을 추적하는 것이 중요하지만, 자바스크립트의 동적인 특성으로 인해 웹 어플리케이션을 실행해 보지 않고 그러한 변수들을 식별하는 것은 매우 어렵다. 때문에, 기존의 오염 분석 도구들은 대상 어플리케이션을 실행하는 오버헤드가 존재하는 동적 오염 분석을 사용하도록 개발되었다. 본 논문에서는 타입스크립트(자바스크립트의 상위집합) 컴파일러를 활용해 얻은 심볼 정보를 기반으로 데이터의 흐름을 정확히 추적하고, 타입스크립트 코드에서 보안 취약점을 발견하는 새로운 정적 오염 분석 기법을 제안하였다. 제안한 기법은 개발자가 검증되지 않은 사용자 입력 데이터를 포함할 수 있는 변수에 표시를 할 수 있도록 하며, 이를 활용해 사용자 입력 값에 영향을 받는 변수와 데이터를 추적한다. 제안한 기법은 TypeScript 컴파일러에 원활히 통합될 수 있기 때문에, 별도의 도구로 작동하는 기존 분석 도구와 달리 개발자가 개발 과정에서 취약점을 발견할 수 있게 한다. 제안한 기법의 유효성을 확인하기 위해 프로토타입을 구현하였으며, 취약점이 보고된 8개의 웹 어플리케이션을 선정하여 분석을 수행하여 성능을 평가한 결과 기존의 취약점을 모두 탐지할 수 있음을 확인하였다.
Abstract
Taint analysis techniques are popularly used to detect web vulnerabilities originating from unverified user input data, such as Cross-Site Scripting (XSS) and SQL Injection, in web applications written in JavaScript. To detect such vulnerabilities, it would be necessary to trace variables affected by user-submitted inputs. However, because of the dynamic nature of JavaScript, it has been a challenging issue to identify those variables without running the web application code. Therefore, most existing taint analysis tools have been developed based on dynamic taint analysis, which requires the overhead of running the target application. In this paper, we propose a novel static taint analysis technique using symbol information obtained from the TypeScript (a superset of JavaScript) compiler to accurately track data flow and detect security vulnerabilities in TypeScript code. Our proposed technique allows developers to annotate variables that can contain unverified user input data, and uses the annotation information to trace variables and data affected by user input data. Since our proposed technique can seamlessly be incorporated into the TypeScript compiler, developers can find vulnerabilities during the development process, unlike existing analysis tools performed as a separate tool. To show the feasibility of the proposed method, we implemented a prototype and evaluated its performance with 8 web applications with known security vulnerabilities. We found that our prototype implementation could detect all known security vulnerabilities correctly.
참고문헌 (42)
- "SQL Injection | OWASP"[URL]
- "Cross Site Scripting (XSS) Software Attack | OWASP Foundation"[URL]
- "OWASP Top 10 Application Security Ris ks - 2017"[URL]
- K. Cao, "PHP vulnerability detection based on taint analysis", 6th International Conference on Reliability, Infocom Technologies and Optimization (Trends and Future Directions)(ICRITO), pp.436~439 (2017)
- R. Jahanshahi, "You shall not pass:Mitigating SQL Injection Attacks on Legacy Web Applications", Proceedings of the 15th ACM Asia Conference on Computer and Communications Security, pp.445~457 (2020)
- S. F. Syed, "Removal of Web Application Vulnerabilities using Taint Analyzer and Code Corrector", 2019 International Conference on Nascent Technologies in Engineering (ICNTE), pp.1~7 (2019)
- W. Huang, "Type-Based Taint Analysis for Java Web Applications", Fundamental Approaches to Software Engineering. FASE 2014, pp.140~154 (2014)
- B. Livshits, "Finding Security Vulnerabilities in Java Applications with Static Analysis", 14th USENIX Security Symposium (2005)
- M. Backes, "Efficient and Flexible Discovery of PHP Application Vulnerabilities", 2017 IEEE European Symposium on Security and Privacy (EuroS&P), pp.334~349 (2017)
- "Usage statistics of server-side program ming languages for websites" (2021)[URL]
- J. Strimpel, "Building Isomorphic JavaScript Apps", pp.3~13 (2016), O'Reilly Media, Inc
- R. Karim, "Platform-Independent Dynamic Taint Analysis for JavaScript", IEEE Transactions on Software Engineering, 46(12), pp.1364~1379 (2020)
- R. Wang, "TT-XSS : A novel taint tracking based dynamic detection framework for DOM Cross-Site Scripting", J. Parallel Distributed Comput, 118, pp.100~106 (2018)
- S. Wei, "Practical blended taint analysis for JavaScript", Proceedings of the 2013International Symposium on Software Testing and Analysis (ISSTA 2013), pp.336~346 (2013)
- "Static Code Analysis Control | OWASP Foundation"[URL]
- "TypeScript: Typed JavaScript at Any Scale"[URL]
- Z. Gao, "To Type or Not to Type: QuantifyingDetectable Bugs in JavaScript", 2017 IEEE, 2017, 758~769
- "State of JS 2020: JavaScript Flavors"[URL]
- "TypeScript Compiler Internals"[URL]
- B. Stock, "Precise Client-side Protection against DOM-based Cross-Site Scripting", 23rd USENIX Security Symposium, pp.655~670 (2014)
- S. Lekies, "25million flows later: large-scale detection of DOM-based XSS", Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pp.1193~1204 (2013)
- "LGTM – Continuous security analysis"[URL]
- "SonarQube - Code Quality and Code Security"[URL]
- "DeepSource: Automate code reviews with static analysis"[URL]
- "Use JSDoc: Index"[URL]
- "Declaration Files"[URL]
- "DefinitelyTyped/DefinitelyTyped"[URL]
- "Express - Node.js web application framework"[URL]
- "mysql2 - npm"[URL]
- C. Staicu, "Extracting Taint Specifications for JavaScript Libraries", 2020 IEEE, 2020, 198~209
- C. Staicu, "SYNODE: Understanding and Automatically Preventing Injection Attacks on NODE.JS", Network and Distributed Systems Security (NDSS)Symposium 2018 (2018)
- "taser/new-lgtm-alerts.md"[URL]
- "mnutt/davros"[URL]
- "FineUploader/server-examples"[URL]
- "giper45/DockerSecurityPlayground"[URL]
- "spikebrehm/isomorphic-tutorial"[URL]
- "AmpersandJS/ampersand"[URL]
- "halohalospecial/atom-elmjutsu"[URL]
- "nhn/tui-editor #1022"[URL]
- "CVE-2019-1020008: stacktable.js before 1.0.4 allows XSS"[URL]
- "The exponential cost of fixing bugs"[URL]
- "Flow: A Static Type Checker for JavaScript"[URL]