Position paper: Why are there so many vulnerabilities in web applications?

Wenliang Du; Karthick Jayaraman; Xi Tan; Tongbo Luo; Steve Chapin

doi:10.1145/2073276.2073285

Position paper: Why are there so many vulnerabilities in web applications?

Wenliang Du, Karthick Jayaraman, Xi Tan, Tongbo Luo, Steve Chapin

Department of Electrical Engineering & Computer Science

Research output: Chapter in Book/Entry/Poem › Conference contribution

4 Scopus citations

Abstract

As the Web has become more and more ubiquitous, the number of attacks on web applications have increased substantially. According to a recent report, over 80 percent of web applications have had at least one serious vulnerability. This percentage is alarmingly higher than traditional applications. Something must be fundamentally wrong in the web infrastructure. Based on our research, we have formulated the following position: when choosing the stateless framework for the Web, we ignored a number of security properties that are essential to applications. As a result, the Trusted Computing Base(TCB) of the Web has significant weaknesses. To build secure stateful applications on top of a weakened TCB, developers have to implement extra protection logic in their web applications, making development difficult and error prone, and thereby causing a number of security problems in web applications. In this paper, we will present evidence, justification, and in-depth analysis to support this position.

Original language	English (US)
Title of host publication	NSPW'11 - Proceedings of the 2011 New Security Paradigms Workshop
Pages	83-93
Number of pages	11
DOIs	https://doi.org/10.1145/2073276.2073285
State	Published - 2011
Event	2011 New Security Paradigms Workshop, NSPW'11 - Marin County, CA, United States Duration: Sep 12 2011 → Sep 15 2011

Publication series

Name	Proceedings New Security Paradigms Workshop

Other

Other	2011 New Security Paradigms Workshop, NSPW'11
Country/Territory	United States
City	Marin County, CA
Period	9/12/11 → 9/15/11

Keywords

access control
browser
web security
web server

ASJC Scopus subject areas

Safety, Risk, Reliability and Quality
Hardware and Architecture
Software
Information Systems

Access to Document

10.1145/2073276.2073285

Cite this

Du, W, Jayaraman, K, Tan, X, Luo, T & Chapin, S 2011, Position paper: Why are there so many vulnerabilities in web applications? in NSPW'11 - Proceedings of the 2011 New Security Paradigms Workshop. Proceedings New Security Paradigms Workshop, pp. 83-93, 2011 New Security Paradigms Workshop, NSPW'11, Marin County, CA, United States, 9/12/11. https://doi.org/10.1145/2073276.2073285

@inproceedings{1b7a3762cbac4513ac2391d4fdf9ae9c,

title = "Position paper: Why are there so many vulnerabilities in web applications?",

abstract = "As the Web has become more and more ubiquitous, the number of attacks on web applications have increased substantially. According to a recent report, over 80 percent of web applications have had at least one serious vulnerability. This percentage is alarmingly higher than traditional applications. Something must be fundamentally wrong in the web infrastructure. Based on our research, we have formulated the following position: when choosing the stateless framework for the Web, we ignored a number of security properties that are essential to applications. As a result, the Trusted Computing Base(TCB) of the Web has significant weaknesses. To build secure stateful applications on top of a weakened TCB, developers have to implement extra protection logic in their web applications, making development difficult and error prone, and thereby causing a number of security problems in web applications. In this paper, we will present evidence, justification, and in-depth analysis to support this position.",

keywords = "access control, browser, web security, web server",

author = "Wenliang Du and Karthick Jayaraman and Xi Tan and Tongbo Luo and Steve Chapin",

year = "2011",

doi = "10.1145/2073276.2073285",

language = "English (US)",

isbn = "9781450310789",

series = "Proceedings New Security Paradigms Workshop",

pages = "83--93",

booktitle = "NSPW'11 - Proceedings of the 2011 New Security Paradigms Workshop",

note = "2011 New Security Paradigms Workshop, NSPW'11 ; Conference date: 12-09-2011 Through 15-09-2011",

}

TY - GEN

T1 - Position paper

T2 - 2011 New Security Paradigms Workshop, NSPW'11

AU - Du, Wenliang

AU - Jayaraman, Karthick

AU - Tan, Xi

AU - Luo, Tongbo

AU - Chapin, Steve

PY - 2011

Y1 - 2011

N2 - As the Web has become more and more ubiquitous, the number of attacks on web applications have increased substantially. According to a recent report, over 80 percent of web applications have had at least one serious vulnerability. This percentage is alarmingly higher than traditional applications. Something must be fundamentally wrong in the web infrastructure. Based on our research, we have formulated the following position: when choosing the stateless framework for the Web, we ignored a number of security properties that are essential to applications. As a result, the Trusted Computing Base(TCB) of the Web has significant weaknesses. To build secure stateful applications on top of a weakened TCB, developers have to implement extra protection logic in their web applications, making development difficult and error prone, and thereby causing a number of security problems in web applications. In this paper, we will present evidence, justification, and in-depth analysis to support this position.

AB - As the Web has become more and more ubiquitous, the number of attacks on web applications have increased substantially. According to a recent report, over 80 percent of web applications have had at least one serious vulnerability. This percentage is alarmingly higher than traditional applications. Something must be fundamentally wrong in the web infrastructure. Based on our research, we have formulated the following position: when choosing the stateless framework for the Web, we ignored a number of security properties that are essential to applications. As a result, the Trusted Computing Base(TCB) of the Web has significant weaknesses. To build secure stateful applications on top of a weakened TCB, developers have to implement extra protection logic in their web applications, making development difficult and error prone, and thereby causing a number of security problems in web applications. In this paper, we will present evidence, justification, and in-depth analysis to support this position.

KW - access control

KW - browser

KW - web security

KW - web server

UR - http://www.scopus.com/inward/record.url?scp=84855668211&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84855668211&partnerID=8YFLogxK

U2 - 10.1145/2073276.2073285

DO - 10.1145/2073276.2073285

M3 - Conference contribution

AN - SCOPUS:84855668211

SN - 9781450310789

T3 - Proceedings New Security Paradigms Workshop

SP - 83

EP - 93

BT - NSPW'11 - Proceedings of the 2011 New Security Paradigms Workshop

Y2 - 12 September 2011 through 15 September 2011

ER -

Position paper: Why are there so many vulnerabilities in web applications?

Abstract

Publication series

Other

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this