Artemis: Toward Accurate Detection of Server-Side Request Forgeries through LLM-Assisted Inter-Procedural Path-Sensitive Taint Analysis

2025-02-28

AI Summary

This work addresses the low detection accuracy of Server-Side Request Forgery (SSRF) vulnerabilities in PHP web applications. We propose a large language model (LLM)-assisted, interprocedural, path-sensitive taint analysis method. To our knowledge, this is the first approach to integrate LLMs into PHP static analysis, enabling dynamic-type awareness, automatic construction of implicit call graphs, and LLM-driven semantic rule generation. Moreover, we introduce path-condition compatibility analysis to significantly reduce false positives. Evaluated on 250 real-world PHP projects, our method identifies 106 confirmed SSRF vulnerabilities—including 35 previously unknown ones—and has led to 24 assigned CVEs. It achieves a precision of 93.2% with only 15 false positives, substantially outperforming state-of-the-art tools.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models
• Computer Vision: Large Vision Models

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Server-side request forgery (SSRF) vulnerabilities are inevitable in PHP web applications. Existing static tools in detecting vulnerabilities in PHP web applications neither contain SSRF-related features to enhance detection accuracy nor consider PHP's dynamic type features. In this paper, we present Artemis, a static taint analysis tool for detecting SSRF vulnerabilities in PHP web applications. First, Artemis extracts both PHP built-in and third-party functions as candidate source and sink functions. Second, Artemis constructs both explicit and implicit call graphs to infer functions' relationships.Third, Artemis performs taint analysis based on a set of rules that prevent over-tainting and pauses when SSRF exploitation is impossible.Fourth, Artemis analyzes the compatibility of path conditions to prune false positives.We have implemented a prototype of Artemis and evaluated it on 250 PHP web applications. Artemis reports 207 true vulnerable paths (106 true SSRFs) with 15 false positives. Of the 106 detected SSRFs, 35 are newly found and reported to developers, with 24 confirmed and assigned CVE IDs.

Problem

• Detects SSRF vulnerabilities in PHP web applications
• Improves accuracy by considering PHP's dynamic type features
• Reduces false positives through path condition analysis

Innovation

• LLM-assisted inter-procedural taint analysis
• Explicit and implicit call graph construction
• Path condition compatibility analysis