Wang Enze, Xie Wei, Li Shuhuan, Liu Runhao, Zhou Yuan, Wang Zhenhua, Ma Shuoyoucheng, Yang Wantong, Wang Baosheng
College of Computer Science and Technology, National University of Defense Technology, No. 137 Yanwachi Street, Changsha 410073, China.
Sensors (Basel). 2025 May 5;25(9):2913. doi: 10.3390/s25092913.
Broken access control vulnerabilities pose significant security risks to the protected web interfaces of IoT devices, enabling adversaries to gain unauthorized access to sensitive configurations and even use them as stepping stones for attacking the intranet. Despite its ranking as the first in the latest OWASP Top 10, there remains a lack of effective methodologies to detect these vulnerabilities systematically. We present ACBreaker, a novel methodology powered by a large language model (LLM), to effectively identify broken access control vulnerabilities in the protected web interfaces of IoT devices. Our methodology consists of three stages. The initial stage transforms firmware code that exceeds the LLM context window into semantically intact code snippets. The second stage involves using an LLM to extract device-specific information from firmware code. The final stage integrates this information into the mutation-based fuzzer to improve fuzzing effectiveness and employ differential analysis to identify vulnerabilities. We evaluated ACBreaker across 11 IoT devices, analyzing 1,274,646 lines of code and discovering 39 previously unknown vulnerabilities. We further analyzed these vulnerabilities, categorizing them into three types that contribute to protected interface evasion, and provided mitigation suggestions. These vulnerabilities were responsibly disclosed to vendors, with CVE IDs assigned to those in six IoT devices.
访问控制失效漏洞对物联网设备受保护的Web接口构成了重大安全风险，使攻击者能够未经授权访问敏感配置，甚至将其用作攻击内部网络的跳板。尽管在最新的OWASP十大漏洞中排名第一，但仍然缺乏系统检测这些漏洞的有效方法。我们提出了ACBreaker，这是一种由大语言模型（LLM）驱动的新颖方法，用于有效识别物联网设备受保护Web接口中的访问控制失效漏洞。我们的方法包括三个阶段。初始阶段将超过LLM上下文窗口的固件代码转换为语义完整的代码片段。第二阶段使用LLM从固件代码中提取特定于设备的信息。最后阶段将此信息集成到基于变异的模糊测试器中，以提高模糊测试的有效性，并采用差分分析来识别漏洞。我们在11个物联网设备上评估了ACBreaker，分析了1,274,646行代码，发现了39个以前未知的漏洞。我们进一步分析了这些漏洞，将它们分为有助于规避受保护接口的三种类型，并提供了缓解建议。这些漏洞已向供应商进行了负责任的披露，六个物联网设备中的漏洞被分配了CVE编号。
