Bringing Binary Exploitation at Port 80: Understanding C Vulnerabilities in WebAssembly

Emmanuele Massidda, Lorenzo Pisu, Davide Maiorca, Giorgio Giacinto

2024

Abstract

WebAssembly (Wasm) has emerged as a novel approach for integrating binaries into web applications starting from various programming languages such as C, Rust and Python. Despite the numerous claims about its memory safety, issues such as buffer overflow, format strings, use after free, and integer overflow have resurfaced within Wasm. These vulnerabilities can be used to impact web application security, potentially leading to critical issues like Cross-Site Scripting (XSS) and Remote Code Execution (RCE). Our work aims to demonstrate how memory-related vulnerabilities in C codes, when compiled into Wasm, can be exploited for XSS and RCE. Our methodology proposes proof of concepts related to exploiting important stack- and heap-based vulnerabilities. In particular, we demonstrate for the first time that specific vulnerabilities (such as format string) can be effectively employed to achieve arbitrary read and write in Wasm contexts. Our results pose serious concerns about the reliability of Wasm in terms of memory safety, which we believe should be addressed in the next releases.

Paper Citation

in Harvard Style

Massidda E., Pisu L., Maiorca D. and Giacinto G. (2024). Bringing Binary Exploitation at Port 80: Understanding C Vulnerabilities in WebAssembly. In Proceedings of the 21st International Conference on Security and Cryptography - Volume 1: SECRYPT; ISBN 978-989-758-709-2, SciTePress, pages 552-559. DOI: 10.5220/0012852400003767

in Bibtex Style

@conference{secrypt24,
author={Emmanuele Massidda and Lorenzo Pisu and Davide Maiorca and Giorgio Giacinto},
title={Bringing Binary Exploitation at Port 80: Understanding C Vulnerabilities in WebAssembly},
booktitle={Proceedings of the 21st International Conference on Security and Cryptography - Volume 1: SECRYPT},
year={2024},
pages={552-559},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0012852400003767},
isbn={978-989-758-709-2},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 21st International Conference on Security and Cryptography - Volume 1: SECRYPT
TI - Bringing Binary Exploitation at Port 80: Understanding C Vulnerabilities in WebAssembly
SN - 978-989-758-709-2
AU - Massidda E.
AU - Pisu L.
AU - Maiorca D.
AU - Giacinto G.
PY - 2024
SP - 552
EP - 559
DO - 10.5220/0012852400003767
PB - SciTePress