Ulysses creates verifiable web security exploits automatically
Ulysses: A Security Harness For Synthesizing Verifiable Web Exploits
Cryptography and SecuritySoftware Engineering
Summary
Finding security weaknesses in software can be really tough, especially when trying to prove these weaknesses actually exist. The authors developed Ulysses, a system that uses multiple AI agents to create and verify exploits for web applications. It checks if a potential security problem is real by testing different ways to exploit it and confirming the results. Their tests on various real web apps showed Ulysses could reliably prove many known vulnerabilities and even found new ones.
What this means in practice
- •For web security teams: Automatically verify and demonstrate security vulnerabilities in web applications to improve security assessments.
- •For penetration testers: Generate reliable and verifiable exploits to confirm security flaws during penetration testing.
Authors
Aditya Oke, André Vicente Duarte, Rui Melo, Shubham Gandhi, Nachiket Kotalwar, Charmi Khandor, Danqing Wang, Carolyn Rosé, Lei Li
Abstract
How can an AI agent automatically discover security vulnerabilities in any software repository? Existing approaches use LLMs to generate software vulnerability exploits. However, it is challenging for an LLM to reliably verify its own generated exploits. In this paper, we propose Ulysses, a multi-agent security harness to synthesize verifiable vulnerability exploits for web applications. Ulysses converts candidate vulnerability findings into verified Proofs of Exploitability by iteratively exploring exploit hypotheses and establishing success in independently observed execution effects. We evaluated Ulysses on WebExploitGym, a curated benchmark of exploitable instances from 25 real-world web applications that span 5 languages and 7 frameworks. Ulysses produces verified proofs for 10 of 25 real-world advisories. It also discovered 4 new proofs of exploitability that have never been previously reported.