FLAX: Systematic Discovery of Client-side Validation Vulnerabilities in Rich Web Applications.

TLDR

The rapid growth of web 2.0 has expanded client‑side components, yet prior vulnerability research has focused mainly on server‑side flaws, leaving client‑side validation gaps largely unexplored. This study introduces client‑side validation (CSV) vulnerabilities and aims to systematically uncover them using dynamic analysis. The authors develop FLAX, a lightweight dynamic analysis tool that systematically scans JavaScript code for CSV vulnerabilities. Empirical evaluation shows that CSV vulnerabilities are common, FLAX detects them efficiently with no false positives, and it has already uncovered 11 real‑world flaws.

Abstract

The complexity of the client-side components of web applications has exploded with the increase in popularity of web 2.0 applications. Today, traditional desktop applications, such as document viewers, presentation tools and chat applications are commonly available as online JavaScript applications. Previous research on web vulnerabilities has primarily concentrated on flaws in the server-side components of web applications. This paper highlights a new class of vulnerabilities, which we term client-side validation (or CSV) vulnerabilities. CSV vulnerabilities arise from unsafe usage of untrusted data in the client-side code of the web application that is typically written in JavaScript. In this paper, we demonstrate that they can result in a broad spectrum of attacks. Our work provides empirical evidence that CSV vulnerabilities are not merely conceptual but are prevalent in today’s web applications. We propose dynamic analysis techniques to systematically discover vulnerabilities of this class. The techniques are light-weight, efficient, and have no false positives. We implement our techniques in a prototype tool called FLAX, which scales to real-world applications and has discovered 11 vulnerabilities in the wild so far.