[Paper Review] Measuring the Leakage and Exploitability of Authentication Secrets in Super-apps: The WeChat Case

Supraja Baskaran, Lianying Zhao+2 more|arXiv (Cornell University)|Jul 18, 2023

Advanced Malware Detection TechniquesComputer Science3 citations

TL;DR

This paper measures the leakage and exploitability of authentication secrets in WeChat and Baidu mini-apps, revealing that 32.8% of 110,993 analyzed WeChat mini-apps hard-code their developer secrets. The authors develop a detection framework to identify such secrets and demonstrate that attackers can abuse them to compromise mini-apps, impersonate developers, and access sensitive data or disrupt services.

ABSTRACT

We conduct a large-scale measurement of developers' insecure practices leading to mini-app to super-app authentication bypass, among which hard-coding developer secrets for such authentication is a major contributor. We also analyze the exploitability and security consequences of developer secret leakage in mini-apps by examining individual super-app server-side APIs. We develop an analysis framework for measuring such secret leakage, and primarily analyze 110,993 WeChat mini-apps, and 10,000 Baidu mini-apps (two of the most prominent super-app platforms), along with a few more datasets to test the evolution of developer practices and platform security enforcement over time. We found a large number of WeChat mini-apps (36,425, 32.8%) and a few Baidu mini-apps (112) leak their developer secrets, which can cause severe security and privacy problems for the users and developers of mini-apps. A network attacker who does not even have an account on the super-app platform, can effectively take down a mini-app, send malicious and phishing links to users, and access sensitive information of the mini-app developer and its users. We responsibly disclosed our findings and also put forward potential directions that could be considered to alleviate/eliminate the root causes of developers hard-coding the app secrets in the mini-app's front-end code.

Motivation & Objective

• To investigate the prevalence of hard-coded authentication secrets in mini-apps hosted on super-app platforms like WeChat and Baidu.
• To analyze the security consequences of such secret leakage, particularly in the context of server-side API abuse.
• To evaluate the exploitability of leaked secrets by assessing unauthorized access to super-app backend services.
• To identify root causes of insecure development practices and propose mitigation strategies for platform providers and developers.
• To measure the evolution of developer security practices and platform enforcement mechanisms over time using large-scale data.

Proposed method

• Developed a custom analysis framework to detect hard-coded app secrets in mini-app source code using static and dynamic analysis techniques.
• Collected and reverse-engineered 110,993 WeChat mini-apps and 10,000 Baidu mini-apps via public distribution channels and client-side extraction.
• Automated extraction of app secrets from mini-app code using pattern matching and code analysis, validated against official documentation.
• Mapped detected secrets to super-app server-side APIs to assess their potential for unauthorized access and abuse.
• Conducted security testing by simulating attacker behavior: sending unauthorized API requests using leaked secrets to evaluate impact.
• Responsible disclosure was performed with platform vendors after identifying vulnerabilities.

Experimental results

Research questions

• RQ1 What is the prevalence of hard-coded app secrets in WeChat and Baidu mini-apps?
• RQ2 To what extent can leaked app secrets be exploited to gain unauthorized access to super-app backend services?
• RQ3 What are the real-world security and privacy consequences of such secret leakage for mini-app developers and end users?
• RQ4 How do current super-app platforms enforce security policies to prevent secret leakage, and where do they fall short?
• RQ5 What are the long-term trends in developer practices and platform enforcement regarding secret handling in mini-app ecosystems?

Key findings

• 32.8% of 110,993 analyzed WeChat mini-apps (36,425 apps) were found to hard-code their developer secrets, indicating widespread insecure development practices.
• 112 out of 10,000 Baidu mini-apps were found to leak their app secrets, suggesting a lower but still significant leakage rate on that platform.
• An attacker without a super-app account can exploit leaked secrets to impersonate a mini-app, send phishing links, and access sensitive data from the mini-app’s backend.
• Leaked secrets enable full control over server-side APIs, allowing attackers to take down mini-app services, exfiltrate user data, and perform unauthorized operations.
• The study confirms that the root cause lies in developers not following platform security guidelines, and platforms failing to enforce secret protection at scale.
• The findings were responsibly disclosed to WeChat and Baidu, highlighting the need for better platform-level enforcement and developer education.