WebSpec, a formal framework for browser security analysis, reveals new cookie attack

guest · Jan 9, 2022

January 8, 2022

Folks at Technische Universität Wien in Austria have devised a formal security framework called WebSpec to analyze browser security.

And they've used it to identify multiple logical flaws affecting web browsers, revealing a new cookie-based attack and an unresolved Content Security Policy contradiction.
These logical flaws are not necessarily security vulnerabilities, but they can be. They're inconsistencies between Web platform specifications and the way these specs actually get implemented within web browsers.
Click to expand...

WebSpec was developed by Lorenzo Veronese, Benjamin Farinier, Mauro Tempesta, Marco Squarcina, Matteo Maffei in an effort to bring rigor to web security through automated, verifiable rule checking rather than manual evaluation.

Browsers, as they explain in an academic paper, "WebSpec: Towards Machine-Checked Analysis of Browser Security Mechanisms," have become tremendously complex and continue to become more so as additional components get added to the web platform.
Click to expand...

"In particular, we show how WebSpec is able to discover a new attack on the __Host- prefix for cookies as well as a new inconsistency between the inheritance rules for the Content Security Policy and a planned change in the HTML standard," the paper explains.

HTTP cookies prefixed with "__Host-" are supposed to only be set by the host domain or scripts included on pages on that domain. WebSpec, however, found an attack to break the related invariant test.
Click to expand...

arXiv: WebSpec: Towards Machine-Checked Analysis of Browser Security Mechanisms
(PDF): https://arxiv.org/pdf/2201.01649

We showcase the effectiveness of WebSpec by discovering two new logical flaws caused by the interaction of different browser mechanisms and by identifying three previously discovered logical flaws in the current Web platform, as well as five in old versions. Finally, we show how WebSpec can aid the verification of our proposed changes to amend the reported inconsistencies affecting the current Web platform.
Click to expand...

Log in or Sign up

WebSpec, a formal framework for browser security analysis, reveals new cookie attack

guest Guest

Log in or Sign up

WebSpec, a formal framework for browser security analysis, reveals new cookie attack

guest Guest

Useful Searches