Automated removal of cross site scripting vulnerabilities in web applications

• Published in: Information and software technology Vol. 54; no. 5; pp. 467 - 478
• Main Authors: Shar, Lwin Khin, Tan, Hee Beng Kuan
• Format: Journal Article
• Language: English
• Published: Amsterdam Elsevier B.V 01.05.2012; Elsevier Science Ltd
• Subjects: Automated bug fixing; Character escaping; Codes; Computer programs; Cross site scripting; Cybersecurity; Encoding; Injection vulnerability; Internet; Java (programming language); Mathematical analysis; Scripts; Software engineering; Studies; Systems development; Vectors (mathematics); Web security; Websites; World Wide Web; Injection vulnerability; Encoding; Web security; Character escaping; Automated bug fixing; Cross site scripting
• ISSN: 0950-5849; 1873-6025
• DOI: 10.1016/j.infsof.2011.12.006

Cross site scripting (XSS) vulnerability is among the top web application vulnerabilities according to recent surveys. This vulnerability occurs when a web application uses inputs received from users in web pages without properly checking them. This allows an attacker to inject malicious scripts in web pages via such inputs such that the scripts perform malicious actions when a client visits the exploited web pages. Such an attack may cause serious security violations such as account hijacking and cookie theft. Current approaches to mitigate this problem mainly focus on effective detection of XSS vulnerabilities in the programs or prevention of real time XSS attacks. As more sophisticated attack vectors are being discovered, vulnerabilities if not removed could be exploited anytime. To address this issue, this paper presents an approach for removing XSS vulnerabilities in web applications. Based on static analysis and pattern matching techniques, our approach identifies potential XSS vulnerabilities in program source code and secures them with appropriate escaping mechanisms which prevent input values from causing any script execution. We developed a tool, saferXSS, to implement the proposed approach. Using the tool, we evaluated the applicability and effectiveness of the proposed approach based on the experiments on five Java-based web applications. Our evaluation has shown that the tool can be applied to real-world web applications and it automatically removed all the real XSS vulnerabilities in the test subjects.