Later archive addition

ACIDRain: Concurrency-Related Attacks on Database-Backed Web Applications

Todd Warszawski and Peter Bailis · Stanford InfoLab

ACIDRain formalizes attacks that send concurrent web or API requests to exploit weak database isolation or incorrect transaction use. Its language-agnostic 2AD analysis reasons over database-access traces and found 22 verified inventory, gift-card, and purchasing vulnerabilities across twelve e-commerce applications.

Record

Researcher

Todd Warszawski and Peter Bailis

Published by

Stanford InfoLab

Format

Whitepaper

In the archive

• Added to the 2016–17 archive after the original list was published

Tags

• race-condition
• database
• dynamic-analysis
• vulnerability-research
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Todd Warszawski and Peter Bailis, first published at the original source. Preserved copies are kept so the citation survives its host.