What All the PHUZZ Is About: A Coverage-guided Fuzzer for Finding Vulnerabilities in PHP Web Applications

TL;DR

PHUZZ is a coverage-guided fuzzing framework tailored for PHP web applications, effectively detecting multiple vulnerability types and outperforming existing tools, demonstrated through extensive testing on popular plugins and real-world applications.

Contribution

This work introduces PHUZZ, a novel modular fuzzing framework specifically designed for PHP web applications, addressing the gap in coverage-guided fuzzing for web targets.

Findings

PHUZZ detects more vulnerability classes than state-of-the-art fuzzers.

Fuzzing over 1,000 API endpoints revealed 20+ security issues and 2 new CVEs.

PHUZZ outperforms existing fuzzers in effectiveness and coverage.

Abstract

Coverage-guided fuzz testing has received significant attention from the research community, with a strong focus on binary applications, greatly disregarding other targets, such as web applications. The importance of the World Wide Web in everyone's life cannot be overstated, and to this day, many web applications are developed in PHP. In this work, we address the challenges of applying coverage-guided fuzzing to PHP web applications and introduce PHUZZ, a modular fuzzing framework for PHP web applications. PHUZZ uses novel approaches to detect more client-side and server-side vulnerability classes than state-of-the-art related work, including SQL injections, remote command injections, insecure deserialization, path traversal, external entity injection, cross-site scripting, and open redirection. We evaluate PHUZZ on a diverse set of artificial and real-world web applications with known and unknown vulnerabilities, and compare it against a variety of state-of-the-art fuzzers. In order to show PHUZZ' effectiveness, we fuzz over 1,000 API endpoints of the 115 most popular WordPress plugins, resulting in over 20 security issues and 2 new CVE-IDs. Finally, we make the framework publicly available to motivate and encourage further research on web application fuzz testing.