[Back]

S. Calzavara, M. Maffei, C. Schneidewind, M. Tempesta, M. Squarcina:
"WPSE: Fortifying Web Protocols via Browser-Side Security Monitoring";
in: "Proceedings of the 27th USENIX Security Symposium", 27th; issued by: USENIX Association Berkley, CA, USA; USENIX, 2018, ISBN: 978-1-931971-46-1, 1493 - 1510.

We present WPSE, a browser-side security monitor for
web protocols designed to ensure compliance with the
intended protocol flow, as well as confidentiality and in-
tegrity properties of messages. We formally prove that
WPSE is expressive enough to protect web applications
from a wide range of protocol implementation bugs and
web attacks. We discuss concrete examples of attacks
which can be prevented by WPSE on OAuth 2.0 and
SAML 2.0, including a novel attack on the Google imple-
mentation of SAML 2.0 which we discovered by formal-
izing the protocol specification in WPSE. Moreover, we
use WPSE to carry out an extensive experimental evalua-
tion of OAuth 2.0 in the wild. Out of 90 tested websites,
we identify security flaws in 55 websites (61.1%), in-
cluding new critical vulnerabilities introduced by track-
ing libraries such as Facebook Pixel, all of which fixable
by WPSE. Finally, we show that WPSE works flawlessly
on 83 websites (92.2%), with the 7 compatibility issues
being caused by custom implementations deviating from
the OAuth 2.0 specification, one of which introducing a
critical vulnerability.

Security, Protocols, Web, Browser, WPSE

https://publik.tuwien.ac.at/files/publik_273016.pdf