Extracting Database Access-control Policies From Web Applications

TL;DR

This paper presents Ote, a tool that automatically extracts explicit access-control policies from Ruby-on-Rails web applications by analyzing SQL queries, helping identify errors and improve security compliance.

Contribution

It introduces Ote, a novel concolic execution-based method for extracting and simplifying access-control policies from web app code, addressing the challenge of implicit and scattered policies.

Findings

Ote successfully extracted policies from real-world applications.

Extracted policies revealed errors in handwritten policies.

The approach improves understanding and enforcement of data access controls.

Abstract

To safeguard sensitive user data, web developers typically rely on implicit access-control policies, which they implement using access checks and query filters. This ad hoc approach is error-prone as these scattered checks and filters are easy to misplace or misspecify, and the lack of an explicit policy precludes external access-control enforcement. More critically, it is difficult for humans to discern what policy is embedded in application code and what data the application may access -- an issue that worsens as development teams evolve. This paper tackles policy extraction: the task of extracting the access-control policy embedded in an application by summarizing its data queries. An extracted policy, once vetted for errors, can stand alone as a specification for the application's data access, and can be enforced to ensure compliance as code changes over time. We introduce Ote, a policy extractor for Ruby-on-Rails web applications. Ote uses concolic execution to explore execution paths through the application, generating traces of SQL queries and conditions that trigger them. It then merges and simplifies these traces into a final policy that aligns with the observed behaviors. We applied Ote to three real-world applications and compared extracted policies to handwritten ones, revealing several errors in the latter.