Facilitating Access Control Vulnerability Detection in Modern Java Web Applications With Accurate Permission Check Identification

Access-control vulnerabilities have emerged as a significant concern in recent years, posing considerable security risks to a wide range of critical systems. The detection of access-control vulnerabilities in Java web applications poses unique challenges, because heuristics used in the past, e.g., access-control specifications or format-specific runtime logs, may not exist in modern Java web applications using web frameworks. Therefore, to date, there is no effective approach to detecting such vulnerabilities in modern Java web applications. In this paper, we introduce a novel approach, called PCFinder, which leverages multi-level semantics- and context-analysis to conduct accurate permission-check identifications against real-world Java web infrastructures for access-control vulnerability detection. PCFinder successfully discovered 58 high-risk broken access control vulnerabilities, with 30 having been assigned CVE identifiers thus far, in analyzing 50 popular, real-world Java web applications. We also evaluate PCFinder on manually constructed ground-truth data and show that PCFinder achieved a high level of accuracy, i.e., a precision of 94.12% and a recall of 96.97% in identifying permission checks.