CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities in JavaScript Engines
Saved in:
| Title: | CodeAlchemist: Semantics-Aware Code Generation to Find Vulnerabilities in JavaScript Engines |
|---|---|
| Authors: | Han, HyungSeok, Oh, DongHyeon, Cha, Sang Kil |
| Contributors: | Cha, Sang Kil, Oh, DongHyeon |
| Publisher Information: | Internet Society |
| Publication Year: | 2019 |
| Collection: | Korea Advanced Institute of Science and Technology: KOASAS - KAIST Open Access Self-Archiving System |
| Description: | JavaScript engines are an attractive target for attackers due to their popularity and flexibility in building exploits. Current state-of-the-art fuzzers for finding JavaScript engine vulnerabilities focus mainly on generating syntactically correct test cases based on either a predefined context-free grammar or a trained probabilistic language model. Unfortunately, syntactically correct JavaScript sentences are often semantically invalid at runtime. Furthermore, statically analyzing the semantics of JavaScript code is challenging due to its dynamic nature: JavaScript code is generated at runtime, and JavaScript expressions are dynamically-typed. To address this challenge, we propose a novel test case generation algorithm that we call semantics-aware assembly, and implement it in a fuzz testing tool termed CodeAlchemist. Our tool can generate arbitrary JavaScript code snippets that are both semantically and syntactically correct, and it effectively yields test cases that can crash JavaScript engines. We found numerous vulnerabilities of the latest JavaScript engines with CodeAlchemist and reported them to the vendors. |
| Document Type: | conference object |
| Language: | English |
| Relation: | 26th Annual Network and Distributed System Security Symposium (NDSS); http://hdl.handle.net/10203/262597; 2017; 104818; 000680713300048; US; San Diego, CA |
| DOI: | 10.14722/ndss.2019.23263 |
| Availability: | http://hdl.handle.net/10203/262597 https://doi.org/10.14722/ndss.2019.23263 |
| Accession Number: | edsbas.207E3DB6 |
| Database: | BASE |
Nájsť tento článok vo Web of Science | Abstract: | JavaScript engines are an attractive target for attackers due to their popularity and flexibility in building exploits. Current state-of-the-art fuzzers for finding JavaScript engine vulnerabilities focus mainly on generating syntactically correct test cases based on either a predefined context-free grammar or a trained probabilistic language model. Unfortunately, syntactically correct JavaScript sentences are often semantically invalid at runtime. Furthermore, statically analyzing the semantics of JavaScript code is challenging due to its dynamic nature: JavaScript code is generated at runtime, and JavaScript expressions are dynamically-typed. To address this challenge, we propose a novel test case generation algorithm that we call semantics-aware assembly, and implement it in a fuzz testing tool termed CodeAlchemist. Our tool can generate arbitrary JavaScript code snippets that are both semantically and syntactically correct, and it effectively yields test cases that can crash JavaScript engines. We found numerous vulnerabilities of the latest JavaScript engines with CodeAlchemist and reported them to the vendors. |
|---|---|
| DOI: | 10.14722/ndss.2019.23263 |