小程序、大问题：通过动态分析揭示小程序中基于 OAuth 的认证滥用情况
Mini-Programs, Mega-Problems: Unveiling OAuth-based Authentication Misuses in Mini-Programs via Dynamic Analysis
AI总结：
研究通过动态分析揭示小程序中基于 OAuth 的认证滥用问题，设计 MINIAUTH 框架，对大量微信和百度小程序进行分析，发现多种滥用案例及百度 API 加密缺陷，强调加强开发者指导与平台保护的必要性。
摘要：
小程序已成为微信等超级应用中轻量级应用部署的主要范式，超级应用提供 OAuth 机制用于用户登录。但第三方开发者对基于 OAuth 的认证（OBA）流程的不当集成会导致严重安全漏洞。本文发现三种新型运行时 OBA 滥用情况，设计并实现了 MINIAUTH 框架，能自动定位小程序的 OBA 登录页面、动态执行工作流程并分析运行时行为。将其应用于大量微信和百度小程序，发现 1834 个滥用案例，还识别出百度 OBA API 的加密设计缺陷。结果强调需要更强大的开发者指导和增强的平台级保护。
英文摘要：
Mini-programs have become a dominant paradigm for lightweight application deployment within super apps such as WeChat. To support seamless integration, super apps provide OAuth mechanisms for user login. However, improper integration of OAuth-based Authentication (OBA) flows by third-party developers can lead to critical security flaws. In this paper, we discover three new types of runtime OBA misuses that differ from prior static-code-based studies, enabling attackers to impersonate victims. To assess their real-world impact, we design and implement MINIAUTH, the first analysis framework for systematically analyzing OBA misuse at scale. MINIAUTH automatically pinpoints the OBA login page of a mini-program, executes the workflow dynamically, and analyzes its runtime behaviors. This enables it to handle obfuscated mini-programs and uncover vulnerabilities that existing approaches cannot detect. Applying MINIAUTH to 44,273 WeChat and 2,721 Baidu mini-programs, we uncover 1,834 misuse cases, including critical logic flaws that enable client-side identity forgery via exposed credentials and authentication bypass through static or plaintext identifiers. Our cross-platform evaluation further shows that such misuses are not confined to a single ecosystem but consistently appear across different mini-program platforms. We also identify a cryptographic design flaw in Baidu's OBA APIs that allows brute-forcing of session keys. We responsibly disclosed our findings to the developers and platforms, receiving acknowledgments and assigned CNVD/CNNVD IDs. These results underscore the need for more robust developer guidance and enhanced platform-level safeguards.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
