An Analysis of Modern Web Security Vulnerabilities Inside WebAssembly Applications

TL;DR

This paper analyzes security vulnerabilities in WebAssembly applications, demonstrating how binary flaws can compromise web security and proposing best practices for mitigation.

Contribution

It provides a detailed analysis of binary vulnerabilities in WASM, illustrating their impact on web security and offering mitigation strategies.

Findings

Binary vulnerabilities can lead to web security issues like SQL Injection and XS-Leaks.

WASM vulnerabilities can bypass common web security mechanisms.

The paper proposes best practices for secure WASM development.

Abstract

The growth in the adoption of the WebAssembly (WASM) standard has given rise to a rapidly increasing landscape of binary applications that are natively ported to the environment of websites. The flexibility of WASM has made it the preferred way to run fast and resource-heavy applications, replacing a field that JavaScript previously monopolized. Despite its success, researchers have raised concerns over the security implementations of WASM, demonstrating that binary vulnerabilities, such as Buffer Overflows and Use After Free, remain a present danger for WASM binaries. Our work aims to demonstrate that such vulnerabilities, when occurring on a WebAssembly module, can affect the behavior of a web application in unexpected ways, enabling an attacker to exploit vulnerabilities that are typical of the web security landscape. We provide several scenarios to provide examples of how each binary vulnerability might lead to a web security vulnerability, such as SQL Injections, XS-Leaks, and SSTI. Our results show that binary vulnerabilities can invalidate common security mechanisms that web developer implement in their applications, demonstrating how the security of WASM modules remains a problem that needs to be addressed. We also provide a list of best practices and defensive strategies that developers can implement to mitigate the risks associated with running unsafe WASM modules in their web applications.