Abstract

Bugs in the authorisation logic of web applications can expose the data of one user to another. Such data disclosure vulnerabilities are common—they can be caused by a single omitted access control check in the application.

In this talk I will describe FlowWatcher, an HTTP proxy that mitigates data disclosure vulnerabilities in unmodified web applications. FlowWatcher monitors HTTP traffic and shadows part of an application’s access control state based on a rule-based specification of the user-data-access (UDA) policy. The UDA policy states the intended data ownership and how it changes based on observed HTTP requests. FlowWatcher detects violations of the UDA policy by tracking data items that are likely to be unique across HTTP requests and responses of different users. Our evaluation of a prototype implementation of FlowWatcher as a plug-in for the Nginx reverse proxy shows that, with short UDA policies, it can mitigate CVE bugs in six popular web applications.

Short Bio: Dan O’Keeffe is a Post-Doctoral Research Associate in the Large Scale Distributed Systems (LSDS) group at Imperial College London. He holds a PhD in Distributed Systems from the University of Cambridge, and a Bachelor’s Degree in Computer Science from Trinity College Dublin. He also has several years of industrial experience as a software engineer.