Program analyses of web applications for detecting application-specific vulnerabilities

Web applications are prevalent in the modern era, regulating access to sensitive information, functionality and resources. Due to the difficulty in designing and implementing proper security checks for untrusted user inputs and actions, web applications often fall victim to various online attacks. In particular, application-specific vulnerabilities are easy to exploit and often have severe consequences. While the detection of application-independent injection vulnerabilities, such as Cross-Site Scripting (XSS) and SQL injection vulnerabilities, examines individual web pages in isolation, the detection of application-specific vulnerabilities necessitates the examination of both logic flows among web pages and user inputs of each page. The detection of application-specific vulnerabilities is more challenging because such vulnerabilities vary across different applications and designing general detection rules for them is difficult. Since manual code review is error-prone and time-consuming, it is important to develop automated detection techniques. This dissertation presents novel, practical program analyses to detect web application vulnerabilities, especially application-specific ones. It begins by providing the first pure client-side solution to detect XSS worms which exploit XSS vulnerabilities. Unlike XSS worms, logic vulnerabilities are application-specific. Two important types of logic vulnerabilities are access control vulnerabilities in web applications and logic vulnerabilities in e-commerce applications. This dissertation formulates their respective core characteristics and introduces corresponding server-side techniques to detect them. Specifically, for access control vulnerabilities, it describes the first static analysis that infers and enforces implicit access control assumptions, and for logic vulnerabilities in e-commerce applications, it presents the first static detection of logic attacks that cause incorrect payment status. In addition, this dissertation presents practical algorithms and tools which are shown to be scalable and capable of finding unknown vulnerabilities in real-world web applications.