Artemis: Toward Accurate Detection of Server-Side Request Forgeries through(…)
summary
Artemis implements an LLM-assisted interprocedural, path-sensitive taint analysis for PHP that builds explicit and implicit call graphs (including magic methods and dynamic class/method resolution), classifies built-in and third‑party sources/sinks with GPT‑4, and prunes infeasible paths via SMT solving of string/URL constraints. A prototype runs on 250 real apps, reports 207 vulnerable paths (106 true SSRFs) with 15 false positives, discovers 35 new SSRFs and helps obtain 24 CVE IDs, and ships artifacts and reproduction data.
AI-written summary · about
chapters (9)
- 0:00SSRF in PHP
- 1:06Detecting SSRF with static analysis
- 2:51Animus design and modules
- 4:20Sources and syncs in PHP
- 6:32Taint analysis rules
- 8:40Pruning false positives
- 10:48Evaluation vs tools
- 12:14Conclusion and future
- 12:54Q&A
related talks
42mContemporary Automatic Program Analysis
02h 18mWeb application security (Part 2)
20mAdvanced GraphQL Security with AI-Driven Threat Detection
34mCollective Detection Of Harmful Requests
47mWeb Developers, Beware of the Tarpits for SAST in Your Code
28mSLEUTH: Real-time Attack Scenario Reconstruction from COTS Audit Data
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
45mProtection and Verification of Security Design Flaws