Fast Detection of Access Control Vulnerabilities in PHP Applications

Access control vulnerabilities in web applications are on the rise. In its 2010 "Top 10 Most Critical Web Applications Security Risks", the OWASP reported that the prevalence of access control vulnerabilities in web applications increased compared to 2007. However, in contrast to SQL injection and cross-site scripting flaws, access control vulnerabilities comparatively received much less attention from the research community. This paper presents ACMA (Access Control Model Analyzer), a model checking-based tool for the detection of access control vulnerabilities in PHP applications. The core of ACMA uses a lightweight model checker to detect the privileges that are enforced at each statement of an application. Based on this information, ACMA can detect several types of access control vulnerabilities: from forced browsing vulnerabilities to faulty access controls. We show how, when compared to the state of the art, ACMA achieves advantageously comparable results with accelerations up to 890 times faster. Moreover, contrary to the state of the art, ACMA scales up to medium-large applications with large access control models, as shown by the analysis of Moodle, a 400,000+ LOC application counting more than 200 distinct privileges. Results show that ACMA is fast, precise and scalable making it a practical tool for the detection of access control vulnerabilities in real-world applications. A discussion about further extensions to ACMA is also presented.