SLVHound: Static Detection of Session Lingering Vulnerabilities in Modern Java Web Applications
Session Lingering Vulnerability (SLV) is an often overlooked authentication flaw that allows sessions to persist after authentication-sensitive operations. Despite its widespread occurrence and severe impact, SLVs have received little attention. To address this gap, we present the first comprehensive study of SLV in Web applications, introducing a novel detection tool called SLVHound. Our approach employs static analysis of both code and SQL queries to identify authentication-sensitive operations and session expiration.SLVHound then detects SLVs by verifying whether authentication-sensitive operations are consistently followed by session expiration.
We evaluated SLVHound on 15 popular Web applications, uncovering 46 potential vulnerabilities. Further analysis confirmed 44 of them as true SLVs, including 30 previously unreported vulnerabilities, with 14 CVE IDs granted.
Sat 21 JunDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
14:00 - 15:30 | Session5: Software Vulnerability and Security IINew Idea Track / Research Track at Cosmos 3A Chair(s): Chuanyi Li Nanjing University | ||
14:00 15mTalk | Devmp: A Virtual Instruction Extraction Method for Commercial Code Virtualization Obfuscators Research Track Shenqianqian Zhang Key Laboratory of Cyberspace Security, Ministry of Education, Weiyu Dong Information Engineering University, Jian Lin Information Engineering University | ||
14:15 15mTalk | Line-level Semantic Structure Learning for Code Vulnerability Detection Research Track Ziliang Wang Peking University, Ge Li Peking University, Jia Li Tsinghua University, Yihong Dong Peking University, Yingfei Xiong Peking University, Zhi Jin Peking University | ||
14:30 15mTalk | SLVHound: Static Detection of Session Lingering Vulnerabilities in Modern Java Web Applications Research Track Haining Meng SKLP, Institute of Computing Technology, CAS, China; University of Chinese Academy of Sciences, China, Jie Lu SKLP, Institute of Computing Technology, CAS, China; University of Chinese Academy of Sciences, China, Yongheng Huang Institute of Computing Technology at Chinese Academy of Sciences; University of Chinese Academy of Sciences, Lian Li Institute of Computing Technology at Chinese Academy of Sciences; University of Chinese Academy of Sciences | ||
14:45 15mTalk | Def-VAE: Identifying Adversarial Inputs with Robust Latent Representations Research Track Chengye Li Institute of Software, Chinese Academy of Sciences, Changshun Wu Université Grenoble Alpes, Rongjie Yan Institute of Software at Chinese Academy of Sciences; University of Chinese Academy of Sciences | ||
15:00 15mTalk | Fuzzing for Stateful Protocol Programs Based on Constraints between States and Message Types Research Track Kunpeng Jian Institute of Information Engineering, Chinese Academy of Sciences, Yanyan Zou Institute of Information Engineering, Chinese Academy of Sciences, Menghao Li Institute of Information Engineering, Chinese Academy of Sciences, Wei Huo Institute of Information Engineering at Chinese Academy of Sciences | ||
15:15 10mTalk | PriceSleuth: Detecting DeFi Price Manipulation Attacks in Smart Contracts Using LLM and Static Analysis New Idea Track Hao Wu Xi'an JiaoTong University, Haijun Wang Xi'an Jiaotong University, Shangwang Li Xi'an Jiaotong University, Yin Wu Xi'an Jiaotong University, Ming Fan Xi'an Jiaotong University, Yitao Zhao Yunnan Power Grid Co., Ltd, Ting Liu Xi'an Jiaotong University Pre-print | ||
Cosmos 3A is the first room in the Cosmos 3 wing.
When facing the main Cosmos Hall, access to the Cosmos 3 wing is on the left, close to the stairs. The area is accessed through a large door with the number “3”, which will stay open during the event.