On the Security of Parsing Security-Relevant HTTP Headers in Modern Browsers

H. Siewert, M. Kretschmer, M. Niemietz, J. Somorovsky, in: 2022 IEEE Security and Privacy Workshops (SPW), IEEE, 2022.

Download
No fulltext has been uploaded.
Conference Paper | Published | English
Author
Siewert, Hendrik; Kretschmer, Martin; Niemietz, Marcus; Somorovsky, JurajLibreCat
Department
Abstract
Web browsers are among the most important but also complex software solutions to access the web. It is therefore not surprising that web browsers are an attractive target for attackers. Especially in the last decade, security researchers and browser vendors have developed sandboxing mechanisms like security-relevant HTTP headers to tackle the problem of getting a more secure browser. Although the security community is aware of the importance of security-relevant HTTP headers, legacy applications and individual requests from different parties have led to possible insecure configurations of these headers. Even if specific security headers are configured correctly, conflicts in their functionalities may lead to unforeseen browser behaviors and vulnerabilities. Recently, the first work which analyzed duplicated headers and conflicts in headers was published by Calzavara et al. at USENIX Security [1]. The authors focused on inconsistent protections by using both, the HTTP header X-Frame-Options and the framing protection of the Content-Security-Policy. We extend their work by analyzing browser behaviors when parsing duplicated headers, conflicting directives, and values that do not conform to the defined ABNF metalanguage specification. We created an open-source testbed running over 19,800 test cases, at which nearly 300 test cases are executed in the set of 66 different browsers. Our work shows that browsers conform to the specification and behave securely. However, all tested browsers behave differently when it comes, for example, to parsing the Strict-Transport-Security header. Moreover, Chrome, Safari, and Firefox behave differently if the header contains a character, which is not allowed by the defined ABNF. This results in the protection mechanism being fully enforced, partially enforced, or not enforced and thus completely bypassable.
Publishing Year
Proceedings Title
2022 IEEE Security and Privacy Workshops (SPW)
LibreCat-ID

Cite this

Siewert H, Kretschmer M, Niemietz M, Somorovsky J. On the Security of Parsing Security-Relevant HTTP Headers in Modern Browsers. In: 2022 IEEE Security and Privacy Workshops (SPW). IEEE; 2022. doi:10.1109/spw54247.2022.9833880
Siewert, H., Kretschmer, M., Niemietz, M., & Somorovsky, J. (2022). On the Security of Parsing Security-Relevant HTTP Headers in Modern Browsers. 2022 IEEE Security and Privacy Workshops (SPW). https://doi.org/10.1109/spw54247.2022.9833880
@inproceedings{Siewert_Kretschmer_Niemietz_Somorovsky_2022, title={On the Security of Parsing Security-Relevant HTTP Headers in Modern Browsers}, DOI={10.1109/spw54247.2022.9833880}, booktitle={2022 IEEE Security and Privacy Workshops (SPW)}, publisher={IEEE}, author={Siewert, Hendrik and Kretschmer, Martin and Niemietz, Marcus and Somorovsky, Juraj}, year={2022} }
Siewert, Hendrik, Martin Kretschmer, Marcus Niemietz, and Juraj Somorovsky. “On the Security of Parsing Security-Relevant HTTP Headers in Modern Browsers.” In 2022 IEEE Security and Privacy Workshops (SPW). IEEE, 2022. https://doi.org/10.1109/spw54247.2022.9833880.
H. Siewert, M. Kretschmer, M. Niemietz, and J. Somorovsky, “On the Security of Parsing Security-Relevant HTTP Headers in Modern Browsers,” 2022, doi: 10.1109/spw54247.2022.9833880.
Siewert, Hendrik, et al. “On the Security of Parsing Security-Relevant HTTP Headers in Modern Browsers.” 2022 IEEE Security and Privacy Workshops (SPW), IEEE, 2022, doi:10.1109/spw54247.2022.9833880.

Export

Marked Publications

Open Data LibreCat

Search this title in

Google Scholar