[Paper Review] Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs

Giancarlo Pellegrino, Martin Johns+3 more|arXiv (Cornell University)|Aug 29, 2017

Web Application Security Vulnerabilities28 references4 citations

TL;DR

Deemon is the first automated framework for detecting authenticated Cross-Site Request Forgery (aCSRF) vulnerabilities using dynamic analysis and property graph modeling. It infers a unified model from runtime traces, identifies suspicious state-changing requests via graph traversal, and validates vulnerabilities through automated testing, uncovering 14 previously unknown aCSRF flaws in real-world web applications.

ABSTRACT

Cross-Site Request Forgery (CSRF) vulnerabilities are a severe class of web vulnerabilities that have received only marginal attention from the research and security testing communities. While much effort has been spent on countermeasures and detection of XSS and SQLi, to date, the detection of CSRF vulnerabilities is still performed predominantly manually. In this paper, we present Deemon, to the best of our knowledge the first automated security testing framework to discover CSRF vulnerabilities. Our approach is based on a new modeling paradigm which captures multiple aspects of web applications, including execution traces, data flows, and architecture tiers in a unified, comprehensive property graph. We present the paradigm and show how a concrete model can be built automatically using dynamic traces. Then, using graph traversals, we mine for potentially vulnerable operations. Using the information captured in the model, our approach then automatically creates and conducts security tests, to practically validate the found CSRF issues. We evaluate the effectiveness of Deemon with 10 popular open source web applications. Our experiments uncovered 14 previously unknown CSRF vulnerabilities that can be exploited, for instance, to take over user accounts or entire websites.

Motivation & Objective

• To address the lack of automated detection techniques for authenticated CSRF (aCSRF) vulnerabilities, which remain predominantly discovered via manual inspection.
• To develop a model-based approach that captures execution traces, data flows, and architectural tiers in a unified representation for comprehensive vulnerability analysis.
• To enable unsupervised, trace-driven model construction using only GUI interaction recordings, reducing manual configuration.
• To automatically generate and execute security tests to validate candidate vulnerabilities in real applications.
• To assess the current state of aCSRF awareness and identify cases where security-sensitive operations are inconsistently protected.

Proposed method

• Deemon dynamically instruments web applications to collect execution traces, including network requests, server-side operations, and database interactions.
• It constructs a property graph model that unifies state transitions, data flows, and architectural components into a single, analyzable representation.
• Graph traversal techniques are applied to identify state-changing HTTP requests that lack proper CSRF protection mechanisms.
• The framework uses the augmented runtime environment to automatically generate and execute exploit-like tests to validate the exploitability of candidate vulnerabilities.
• Model inference is performed in an unsupervised manner, requiring only recorded GUI interactions as input, enabling scalable and low-effort deployment.
• The approach leverages a query language over property graphs to express and detect suspicious or vulnerable behavioral patterns.

Experimental results

Research questions

• RQ1 Can aCSRF vulnerabilities be detected automatically at scale using dynamic analysis and model-based reasoning?
• RQ2 How effective is a property graph-based modeling paradigm in capturing cross-tier and cross-functional aspects of modern web applications relevant to CSRF?
• RQ3 Can automated test generation based on inferred models reliably validate the exploitability of discovered aCSRF candidates?
• RQ4 What is the current level of awareness and protection for security-sensitive operations in real-world web applications?
• RQ5 Are there patterns in which security-sensitive actions are protected selectively, indicating potential misconfigurations or overlooked vulnerabilities?

Key findings

• Deemon discovered 14 previously unknown aCSRF vulnerabilities across 10 popular open-source web applications, including critical flaws allowing user account takeover and database compromise.
• The framework successfully validated the exploitability of all 14 vulnerabilities through automated test execution, confirming their real-world impact.
• In two cases, Deemon identified alarming protection patterns where security-sensitive operations were secured inconsistently, indicating potential misconfigurations.
• The property graph modeling approach enabled effective detection of complex, cross-tier interactions that traditional scanners and static analyzers often miss.
• The evaluation demonstrated that dynamic, trace-driven modeling outperforms traditional crawling-based scanners in detecting logic and state-based vulnerabilities like aCSRF.
• The results highlight the limitations of current manual detection practices and the urgent need for automated, scalable solutions for aCSRF detection.