Automated Detection of Context-Dependent Broken Access Control

Develop automated testing and oracle techniques to detect and verify context-dependent Broken Access Control vulnerabilities in PHP-based, database-backed web applications, where exploitation requires satisfying preconditions (for example, resource creation or feature activation) that drive the application into specific states before unauthorized access becomes observable.

Background

The paper scopes BACFuzz to role-based access control and focuses on BOLA and BFLA vulnerabilities detectable via SQL DML queries. The authors note that some BAC cases depend on user actions and application state, making them challenging for automated fuzzing because the vulnerability only surfaces after specific preconditions are met.

Context-dependent BAC requires a sequence of actions (e.g., creating resources or enabling features) that transition the application into a state where unauthorized access becomes visible. Automating the discovery, orchestration, and verification of these state-dependent scenarios is identified as beyond the current capabilities of BACFuzz and left open.