Harnessing LLMs for Automating BOLA Detection
Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.
Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.
- LLMs automate BOLA tasks: logic understanding, endpoint dependency mapping, test generation
- BOLA resists fuzzing and SAST because it is a stateless-looking logical error
- Findings include Grafana CVE-2024-1313 and Harbor CVE-2024-22278
- 15 additional CVEs found in Easy!Appointments
- CVEs
- CVE-2024-1313CVE-2024-22278CVE-2023-3285CVE-2023-3286CVE-2023-3287CVE-2023-3288CVE-2023-3289CVE-2023-3290CVE-2023-38047CVE-2023-38048CVE-2023-38049CVE-2023-38050CVE-2023-38051CVE-2023-38052CVE-2023-38053CVE-2023-38054CVE-2023-38055
- Vendors
- Palo Alto Networks
- Products
- GrafanaHarborEasy!Appointments
- Threat actors
- Unit 42
- Organizations
- Palo Alto NetworksUnit 42
- Countries
- US
- AI models
- BOLABuster
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-3285 | A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin) | 7.7 | <1% | ||
| CVE-2023-3287 | A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system | 8.8 group max | <1% | ||
| CVE-2024-1313 | It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to… | 6.5 | <1% | ||
| CVE-2024-22278 | Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations | 4.3 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | clinic.site | . In this medical application, patients can use the API api.clinic[.]site/get_history?visit_id=XXXX to access the doctor visit note |
From the original article
10 min read at unit42.paloaltonetworks.com
This post presents our research on a methodology we call BOLABuster, which uses large language models (LLMs) to detect broken object level authorization (BOLA) vulnerabilities. By automating BOLA detection at scale, we will show promising results in identifying these vulnerabilities in open-source projects. BOLA is a widespread and potentially critical vulnerability in modern APIs and web applications.
By Ravid Mazon, Jay Chen · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.