Session Lingering Vulnerability (SLV) is an often overlooked authentication flaw that allows sessions to persist after authenticationsensitive operations.Despite its widespread occurrence and severe impact, SLVs have received little attention.To address this gap, we present the first comprehensive study of SLV in Web applications, introducing a novel detection tool called SLVHound.Our approach employs static analysis of both code and SQL queries to identify authentication-sensitive operations and session expiration.SLVHound then detects SLVs by verifying whether authenticationsensitive operations are consistently followed by session expiration.We evaluated SLVHound on 15 popular Web applications, uncovering 46 potential vulnerabilities.Further analysis confirmed 44 of them as true SLVs, including 30 previously unreported vulnerabilities, with 16 CVE IDs granted. CCS Concepts• Security and privacy → Web application security.

Broken object-level authorization (BOLA) vulnerabilities are among the most critical security risks facing database-backed applications. However, there is still a significant gap in our systematic understanding of these vulnerabilities. To bridge this gap, we conducted an in-depth study of 101 real-world BOLA vulnerabilities from opensource applications. Our study revealed the four most common object-level authorization models in database-backed application.

Generic programming has found widespread application in object-oriented languages like Java. However, existing context-sensitive pointer analyses fail to leverage the benefits of generic programming. This paper introducesgeneric sensitivity, a new context customization scheme targeting generics. We design our context customization scheme in such a way that generic instantiation sites, i.e., locations instantiating generic classes/methods with concrete types, are always preserved as key context elements. This is realized by augmenting contexts with a type variable lookup map, which is efficiently generated in a context-sensitive manner throughout the analysis process. We have implemented various variants of generic-sensitive analysis in WALA and conducted extensive experiments to compare it with state-of-the-art approaches, including both traditional and selective context-sensitivity methods. The evaluation results demonstrate that generic sensitivity effectively enhances existing context-sensitivity approaches, striking a new balance between efficiency and precision. For instance, it enables a 1-object-sensitive analysis to achieve overall better precision compared to a 2-object-sensitive analysis, with an average speedup of 12.6 times (up to 62 times).

Generic programming has been extensively used in object-oriented programs such as Java. However, existing context-sensitive pointer analyses perform poorly in analyzing generics. This paper introduces generic sensitivity, a new context customization scheme targeting generics. We design our context customization scheme in such a way that generic instantiation sites, i.e., locations instantiating generic classes/methods with concrete types, are always preserved as key context elements. This is realized by augmenting contexts with a type variable lookup map, which is efficiently updated during the analysis in a context-sensitive manner.