Abstract: Broken object level authorization (BOLA) is currently one of the critical security threats to Web applications. As a typical unauthorized access vulnerability, BOLA arises when a system fails to properly validate a user’s access permissions to target objects. The key to static detection of BOLA vulnerabilities lies in: accurately identifying objectlevel sensitive operations and analyzing unprotected access behaviors during path traversal. Since BOLA is an application logiclevel vulnerability, its detection effectiveness directly depends on the precision of understanding the expected objectlevel authorization policies. However, existing detection methods predominantly rely on empirical heuristic rules to identify sensitive and protected operations, making them difficult to adapt to the actual business logic of different applications, resulting in high false positives and false negatives in detection results. To address this limitation, this paper innovatively proposes a large language model (LLM)enhanced static detection method for BOLA vulnerabilities in Web applications, LLM4BOLA. First, leveraging LLM’s advanced code comprehension and semantic reasoning capabilities to infer objectlevel sensitive operations and custom authorization policies in specific business scenarios. Then, identifying diverse permission protection mechanisms. Finally, comprehensively detecting missing objectlevel permission checks along the paths from request entry points to sensitive operations. Experimental results demonstrate that the proposed method not only effectively detects known vulnerabilities but also discovers unknown ones, significantly outperforming traditional rulebased approaches in detection accuracy.

Key words: broken object level authorization, static analysis, vulnerability detection, Web application security, software security

摘要： 对象级授权漏洞(broken object level authorization, BOLA)是当前Web应用面临的严重安全威胁之一.作为典型的越权漏洞，BOLA源于系统未能有效验证用户对目标对象的访问权限.静态检测BOLA漏洞的关键在于：准确识别对象级敏感操作以及分析路径遍历过程中未受保护的访问行为.由于BOLA属于应用逻辑层面的漏洞，其检测效果直接取决于对应用对象级授权预期的理解精度.然而，现有检测方法普遍依赖经验性的启发式规则识别敏感操作和权限保护，难以适配不同应用的实际业务逻辑，导致后续检测结果误报和漏报.为此，创新性地提出基于大语言模型(large language model, LLM)增强的Web应用对象级授权漏洞静态检测方法(LLM4BOLA)：首先利用LLM强大的代码理解与语义推理能力推断特定业务场景下的对象级敏感操作和自定义授权策略；进而识别多样化的权限保护机制；最终检测从请求入口到所有敏感操作路径上的对象级权限缺失情况.实验验证表明，该方法不仅能有效检测已知漏洞，还具备发现未知漏洞的能力，其检测精度显著优于现有基于规则的检测方法.

关键词: 对象级授权漏洞, 静态分析, 漏洞检测, Web应用安全, 软件安全