WAScope: Detecting privacy data leakage with web application-specific API confusion

Abstract

The number of web applications deployed on the internet has exceeded one billion, accumulating vast amounts of user privacy data. The compromise of such data may lead to severe consequences. While existing research has primarily focused on data exfiltration through system APIs, the security risks posed by application-specific APIs have been largely overlooked. These APIs directly manage the collection, processing, and transmission of sensitive user data, making them critical attack surfaces. This study systematically investigates privacy data leakage caused by unauthorized access through web application-specific APIs. We presented WAScope (Web Application-specific API Scope), a dynamic analysis tool that detects privacy leakage by combining API confusion techniques with a customized privacy dictionary. We conducted experiments on 100 real-world web applications using WAScope. The tool identified 15,593 privacy-aware API data flows across 76 applications, among which 2,757 APIs were manually confirmed to expose sensitive data due to improper access controls. Manual validation further validated the findings, revealing a 9% false positive rate. We reported these vulnerabilities to the China National Vulnerability Database (CNVD), receiving 10 official CNVD-IDs that demonstrate the effectiveness of WAScope.