Saved in:
| Main Authors: | , , |
|---|---|
| Format: | Recurso digital |
| Language: | |
| Published: |
Zenodo
2025
|
| Online Access: | https://doi.org/10.5281/zenodo.15593802 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
Table of Contents:
- <p>Modern web applications are becoming increasingly complex. They<br>include multiple dynamic runtime constructs that are difficult to<br>analyze by static application security testing (SAST) tools. These<br>tools often use a graph representation of the code for their analysis.<br>However, built statically, such graphs may miss important data<br>and control flows dependent on runtime information. In addition,<br>the presence of difficult-to-analyze code patterns in modern web<br>applications, referred to as testability tarpits, further reduces the<br>accuracy of statically built graphs. As a result, current SAST tools<br>have several false negatives because of ’hidden’ paths, which are<br>not present in the graphs. In this paper, we present SemFinder,<br>an approach designed to automatically detect such hidden paths.<br>SemFinder uses natural language semantics to hypothesize connec-<br>tions between different locations in the code based on the meaning<br>and similarity of the variables in those locations and test those<br>hypotheses dynamically. We evaluate SemFinder on 30 PHP appli-<br>cations and discover 215 new exploitable hidden paths with respect<br>to existing SAST tools, leading to the submission of 31 new CVEs</p>