Plug 'n' Pray：基于智能体LLM的第三方内容管理系统插件潜在日志文件暴露检测
Plug 'n' Pray: Agentic LLM-based Detection of Potential Log File Exposures in Third-Party Content Management System Plugins
浏览论文内容
中文总结 AI 辅助
本文提出基于智能体LLM的框架，自动检测WordPress插件日志文件暴露风险，在300个流行插件上验证，复现79/81个发现，并总结出分类法及开发者最佳实践。
中文摘要 AI 辅助
内容管理系统（CMS），如WordPress，支撑着互联网的很大一部分（约58%），而它们通过第三方插件实现的可扩展性既是其受欢迎的主要原因，也是其攻击面的主要来源。一个影响重大但研究不足的弱点是CMS插件导致的日志文件暴露，这些插件出于调试或其他目的创建日志文件。如果这些文件保护不足，就可能泄露敏感信息（如凭据、个人数据），这在过去曾导致网站被入侵。在这项工作中，我们提出了一种基于智能体的LLM框架，能够自动检测最流行的CMS（WordPress）插件中潜在的日志文件暴露。我们的智能体通过执行静态和动态分析来检查每个插件。我们在300个安装量最大的WordPress插件（约占所有插件的0.6%）上评估了我们的方法，这些插件合计拥有超过2.5亿次活跃安装，即占官方插件生态系统中所有活跃安装的75%。我们手动验证了每个发现，从62个插件中复现了81个发现中的79个。我们观察到，似乎实施了几种保护措施，我们将其分类为创建控制（如手动日志激活）和访问控制（如.htaccess中的拒绝规则）。然而，我们发现需要多层保护，但并非总是存在。根据这些结果，我们推导出日志文件路径和保护模式的分类法，并为开发者总结出一套安全处理这些文件的最佳实践。最后，我们的研究证实了智能体LLM是安全分析的有用工具。
英文摘要
Content Management Systems (CMS), such as WordPress, power a large share of the web (~58%), and their extensibility through third-party plugins is a major source of their popularity as well as of their attack surface. One high-impact weakness that remains understudied is log file exposure by CMS plugins, which create log files for debugging or other purposes. If these files are insufficiently secured, they can disclose sensitive information (e.g. credentials, personal data) which has led to website compromises in the past. In this work, we present an agentic, LLM-based framework that automatically detects potential log file exposures in plugins of the most popular CMS (WordPress). Our agent analyzes each plugin by performing static and dynamic analysis. We evaluated our approach on the 300 most-installed WordPress plugins (about 0.6% of all), which together account for over 250M active installations, i.e. 75% of all active installations in the official plugin ecosystem. We manually validated each finding, reproducing 79 of 81 findings from 62 plugins. We observed that several protective measures appear to be implemented that we classify as creation-control (e.g. manual log activation) and access-control (e.g. deny rules in .htaccess). However, we find that multi-layered protection is required, but not always present. From these results we derive a taxonomy of log file path and protection patterns and deduce a set of best practices for developers to securely handle them. Finally, our study corroborates that agentic LLMs are an useful tool for security analysis.
发表机构
- Technische Universität Berlin（柏林工业大学）
机构由 AI 辅助整理，请以论文原文为准。
