Symbolic Security Analysis of Ruby-on-Rails Web Applications

Avik Chaudhuri and Jeffrey Foster

Many of today's web applications are built on frameworks that include sophisticated defenses against malicious adversaries. However, mistakes in the way developers deploy those defenses could leave applications open to attack. To address this issue, we introduce Rubyx, a symbolic executor that we use to analyze Ruby-on-Rails web applications for security vulnerabilities. Rubyx specifications can easily be adapted to a variety of properties, since they are built from general assertions, assumptions, and object invariants. We show how to write Rubyx specifications to detect susceptibility to cross-site scripting and cross-site request forgery, insufficient authentication, leaks of secret information, insufficient access control, as well as application-specific security properties. We used Rubyx to check seven web applications from various sources against our specifications. We found many vulnerabilities, and each application was subject to at least one critical attack. Encouragingly, we also found that it was relatively easy to fix most vulnerabilities, and that Rubyx showed the absence of attacks after our fixes. Our results suggest that Rubyx is a promising new way to analyze Ruby-on-Rails web applications for security vulnerabilities.


    author = {Avik Chaudhuri and Jeffrey Foster},
    title = {Symbolic Security Analysis of Ruby-on-Rails Web Applications},
    booktitle = {Proceedings of the 17th ACM Conference on
                 Computer and Communications Security (CCS'10)},
    year = {2010},
    pages = {585--594},
    publisher = {ACM}