BOLABuster: Harnessing LLMs for Automating BOLA Detection

Broken object level authorization, or BOLA, ranks at the top of the OWASP API Security list and appears often in HackerOne reports, yet few tools can find it at scale. The difficulty comes from applications with many roles and resources, stateful workflows where one call depends on earlier calls, and the lack of a clear pattern like the signatures used for injection bugs. The talk presents BOLABuster, a pipeline that starts from an OpenAPI or Swagger file.

The method uses an LLM to shortlist endpoints whose parameters point to sensitive objects, then asks it to infer producer and consumer relationships between endpoints by their meaning rather than by parameter name. Each target endpoint gets a dependency tree and one or more execution paths, which are turned into bash test scripts. The pipeline registers users, runs the tests against a live server using two accounts, and flags successful cross-user requests for human review. In a benchmark against deliberately vulnerable applications, the team reported finding every known BOLA while sending under 1% of the API requests used by RESTler, which found none under default settings.

The presenters described issues found in Harbor, where a maintainer could change project configuration through the API even though the UI blocked it, in Grafana (CVE-2024-1313), and in Easy Appointments, with 15 CVEs. Their lessons: use heuristics where they suffice, validate AI output because models invent endpoints and parameters, split large specs into small relevant pieces, and expect results to depend on the accuracy of the spec. They noted that model costs are falling and that newer models improve results.