Abstract:

The Hypertext Transfer Protocol (HTTP), the core infrastructure of Internet communication, relies on the collaboration of multiple servers in its modern communication model. If the servers in the processing chain do not strictly follow the protocol specifications or have differences in semantic interpretation, systemic semantic inconsistency problems will occur, leading to security threats such as access control strategy bypass, multi-host issues, request smuggling, and cache pollution. Differential fuzz testing analyzes semantic inconsistency problems by observing the differences in the processing results of messages are processed across different servers. To solve the problems of an inaccurate field set range, low mutation efficiency, and single observation dimension in existing tools, this paper proposes an improved differential fuzz testing method. First, a message construction method based on key headers is used to select core fields and streamline the test space. Second, a mutation method based on field semantics is adopted, combining semantic classification and vulnerability characteristics to design mutation operations, thereby enriching the test cases. Third, an extended message analysis method is employed to expand the scope of message analysis to both request and response messages, fully observing the communication process and covering existing scenarios of semantic inconsistency problems. Finally, tests are conducted on 7 commonly used servers, identifying 18 types of server processing differences and verifying 9 pairs of combinations that exhibit semantic inconsistency problems. Compared with similar tools such as t-reqs, the proposed method reduces the size of the test set by an order of magnitude, increases the average proportion of valid test cases by 12.67 percentage points, discovers two additional types of difference problems under the same observation conditions, and expands the test scope to cover all four scenarios of current semantic inconsistency problems.

Key words: Hypertext Transfer Protocol (HTTP), semantic inconsistency, Web security, fuzz testing, differential testing

摘要：

超文本传输协议(HTTP)作为互联网通信的核心基础设施, 其现代通信模型依赖多个服务器协同工作。若处理链中的服务器未严格遵循协议规范或存在语义解释差异, 将引发具有系统性特征的语义不一致问题, 导致访问控制策略绕过、多Host、请求走私及缓存污染等安全威胁。差分模糊测试通过观测不同服务器对报文处理结果的差异, 分析语义不一致问题。为了解决现有工具中字段集合范围失准、突变效率低、观测维度单一的问题, 提出了一种改进的差分模糊测试方法。首先, 通过基于关键首部的报文构建方法, 筛选核心字段精简测试空间; 然后, 采用字段语义的突变方法, 结合语义分类与漏洞特征设计突变方法, 丰富测试用例; 接着, 利用扩展的报文分析方法, 将报文分析范围扩展至请求和响应报文, 完整观测通信过程, 覆盖现有存在语义不一致问题的场景; 最后, 针对常用的7款服务器进行测试, 分析发现18类服务器处理差异问题并验证9对存在语义不一致问题的组合。相比同类工具t-reqs, 该方法将测试集合规模降低1个数量级, 平均提升12.67百分点的有效测试用例占比, 在相同观测条件下额外发现2类新的差异问题, 扩展测试范围覆盖当前语义不一致问题的4类场景。

关键词: 超文本传输协议, 语义不一致, Web安全, 模糊测试, 差分测试