论文标题
科西嘉岛：跨源网络服务标识
CORSICA: Cross-Origin Web Service Identification
论文作者
论文摘要
对于网络以外的攻击者，很难检测到专用网络中的漏洞。虽然有许多用于端口扫描内部主机的方法，可以通过吸引不知情的内部用户进入托管恶意JavaScript代码的外部网页，但尚无此类详细和精确服务标识的方法。原因是相同的原始策略（SOP）阻止默认情况下对其他起源的HTTP响应的访问。我们对SOP中的漏洞进行结构化分析，可用于跨网络边界识别Web应用程序。为此，我们分析了符合标准的Web浏览器的HTML5，CSS和JavaScript功能，这些功能可能会泄漏有关交叉原始含量的敏感信息。结果揭示了几种新型技术，包括泄漏所有常见浏览器中可用的JavaScript功能名称或跨原始请求的样式。我们在称为Corsica的工具中实施和测试这些技术。它可以成功地识别在不同的物联网设备上运行的42个（74％）Web服务中的31个，以及四个最广泛使用的内容管理系统WordPress，Drupal，Joomla和Typo3的版本号。 Corsica还可以平均确定补丁级别至三个版本（WordPress），六个版本（Drupal），两个版本（Joomla）和四个版本（Typo3），平均只有十个请求。此外，Corsica能够识别包含65个漏洞的48个WordPress插件。最后，我们分析缓解策略，并表明拟议但尚未实施跨原始资源策略（CORP）}和SEC-Metadata的策略将阻止我们的识别技术。
Vulnerabilities in private networks are difficult to detect for attackers outside of the network. While there are known methods for port scanning internal hosts that work by luring unwitting internal users to an external web page that hosts malicious JavaScript code, no such method for detailed and precise service identification is known. The reason is that the Same Origin Policy (SOP) prevents access to HTTP responses of other origins by default. We perform a structured analysis of loopholes in the SOP that can be used to identify web applications across network boundaries. For this, we analyze HTML5, CSS, and JavaScript features of standard-compliant web browsers that may leak sensitive information about cross-origin content. The results reveal several novel techniques, including leaking JavaScript function names or styles of cross-origin requests that are available in all common browsers. We implement and test these techniques in a tool called CORSICA. It can successfully identify 31 of 42 (74%) of web services running on different IoT devices as well as the version numbers of the four most widely used content management systems WordPress, Drupal, Joomla, and TYPO3. CORSICA can also determine the patch level on average down to three versions (WordPress), six versions (Drupal), two versions (Joomla), and four versions (TYPO3) with only ten requests on average. Furthermore, CORSICA is able to identify 48 WordPress plugins containing 65 vulnerabilities. Finally, we analyze mitigation strategies and show that the proposed but not yet implemented strategies Cross-Origin Resource Policy (CORP)} and Sec-Metadata would prevent our identification techniques.
