A symbolic execution framework for JavaScript

Prateek Saxena; Devdatta Akhawe; Steve Hanna; Feng Mao; Stephen McCamant; Dawn Song

doi:10.1109/SP.2010.38

A symbolic execution framework for JavaScript

Prateek Saxena, Devdatta Akhawe, Steve Hanna, Feng Mao, Stephen McCamant, Dawn Song

Computer Science and Engineering

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

331 Scopus citations

Abstract

As AJAX applications gain popularity, client-side JavaScript code is becoming increasingly complex. However, few automated vulnerability analysis tools for JavaScript exist. In this paper, we describe the first system for exploring the execution space of JavaScript code using symbolic execution. To handle JavaScript code's complex use of string operations, we design a new language of string constraints and implement a solver for it. We build an automatic end-to-end tool, Kudzu, and apply it to the problem of finding client-side code injection vulnerabilities. In experiments on 18 live web applications, Kudzu automatically discovers 2 previously unknown vulnerabilities and 9 more that were previously found only with a manually-constructed test suite.

Original language	English (US)
Title of host publication	2010 IEEE Symposium on Security and Privacy, SP 2010 - Proceedings
Pages	513-528
Number of pages	16
DOIs	https://doi.org/10.1109/SP.2010.38
State	Published - 2010
Event	31st IEEE Symposium on Security and Privacy, SP 2010 - Berkeley/Oakland, CA, United States Duration: May 16 2010 → May 18 2010

Publication series

Name	Proceedings - IEEE Symposium on Security and Privacy
ISSN (Print)	1081-6011

Other

Other	31st IEEE Symposium on Security and Privacy, SP 2010
Country/Territory	United States
City	Berkeley/Oakland, CA
Period	5/16/10 → 5/18/10

Keywords

String decision procedures
Symbolic execution
Web security

Access

10.1109/SP.2010.38

OpenUrl availability

Full text

Cite this

Saxena, P, Akhawe, D, Hanna, S, Mao, F, McCamant, S & Song, D 2010, A symbolic execution framework for JavaScript. in 2010 IEEE Symposium on Security and Privacy, SP 2010 - Proceedings., 5504700, Proceedings - IEEE Symposium on Security and Privacy, pp. 513-528, 31st IEEE Symposium on Security and Privacy, SP 2010, Berkeley/Oakland, CA, United States, 5/16/10. https://doi.org/10.1109/SP.2010.38

@inproceedings{a8b2d23dd79d4ae68dc8151db6fdf02c,

title = "A symbolic execution framework for JavaScript",

abstract = "As AJAX applications gain popularity, client-side JavaScript code is becoming increasingly complex. However, few automated vulnerability analysis tools for JavaScript exist. In this paper, we describe the first system for exploring the execution space of JavaScript code using symbolic execution. To handle JavaScript code's complex use of string operations, we design a new language of string constraints and implement a solver for it. We build an automatic end-to-end tool, Kudzu, and apply it to the problem of finding client-side code injection vulnerabilities. In experiments on 18 live web applications, Kudzu automatically discovers 2 previously unknown vulnerabilities and 9 more that were previously found only with a manually-constructed test suite.",

keywords = "String decision procedures, Symbolic execution, Web security",

author = "Prateek Saxena and Devdatta Akhawe and Steve Hanna and Feng Mao and Stephen McCamant and Dawn Song",

year = "2010",

doi = "10.1109/SP.2010.38",

language = "English (US)",

isbn = "9780769540351",

series = "Proceedings - IEEE Symposium on Security and Privacy",

pages = "513--528",

booktitle = "2010 IEEE Symposium on Security and Privacy, SP 2010 - Proceedings",

note = "31st IEEE Symposium on Security and Privacy, SP 2010 ; Conference date: 16-05-2010 Through 18-05-2010",

}

TY - GEN

T1 - A symbolic execution framework for JavaScript

AU - Saxena, Prateek

AU - Akhawe, Devdatta

AU - Hanna, Steve

AU - Mao, Feng

AU - McCamant, Stephen

AU - Song, Dawn

PY - 2010

Y1 - 2010

N2 - As AJAX applications gain popularity, client-side JavaScript code is becoming increasingly complex. However, few automated vulnerability analysis tools for JavaScript exist. In this paper, we describe the first system for exploring the execution space of JavaScript code using symbolic execution. To handle JavaScript code's complex use of string operations, we design a new language of string constraints and implement a solver for it. We build an automatic end-to-end tool, Kudzu, and apply it to the problem of finding client-side code injection vulnerabilities. In experiments on 18 live web applications, Kudzu automatically discovers 2 previously unknown vulnerabilities and 9 more that were previously found only with a manually-constructed test suite.

AB - As AJAX applications gain popularity, client-side JavaScript code is becoming increasingly complex. However, few automated vulnerability analysis tools for JavaScript exist. In this paper, we describe the first system for exploring the execution space of JavaScript code using symbolic execution. To handle JavaScript code's complex use of string operations, we design a new language of string constraints and implement a solver for it. We build an automatic end-to-end tool, Kudzu, and apply it to the problem of finding client-side code injection vulnerabilities. In experiments on 18 live web applications, Kudzu automatically discovers 2 previously unknown vulnerabilities and 9 more that were previously found only with a manually-constructed test suite.

KW - String decision procedures

KW - Symbolic execution

KW - Web security

UR - http://www.scopus.com/inward/record.url?scp=77955220343&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=77955220343&partnerID=8YFLogxK

U2 - 10.1109/SP.2010.38

DO - 10.1109/SP.2010.38

M3 - Conference contribution

AN - SCOPUS:77955220343

SN - 9780769540351

T3 - Proceedings - IEEE Symposium on Security and Privacy

SP - 513

EP - 528

BT - 2010 IEEE Symposium on Security and Privacy, SP 2010 - Proceedings

T2 - 31st IEEE Symposium on Security and Privacy, SP 2010

Y2 - 16 May 2010 through 18 May 2010

ER -

A symbolic execution framework for JavaScript

Abstract

Publication series

Other

Keywords

Access

OpenUrl availability

Other files and links

Fingerprint

Cite this