Repairing Broken Access Control in Web Applications with LLMs (arxiv.org)

A recent empirical benchmark study has unveiled a novel approach to repairing Broken Access Control (BAC) vulnerabilities in web applications using Large Language Models (LLMs). BAC is considered one of the most critical web application security concerns, yet automated repair methods for such logic vulnerabilities remain underexplored. The study introduces BAC-Bench, the first dedicated benchmark consisting of 46 real-world BAC vulnerabilities from six popular web applications, assessed through a well-defined framework focusing on four dimensions: Position, Coverage, Mechanism, and Content. The findings indicate that while base LLMs achieved an average repair rate of 37.68%, employing minimal scaffolds such as Apply-Feedback and Navigate-and-Locate raised this rate to 66.03%, with the best model reaching 75.36%. Importantly, LLM-generated patches occasionally outperformed official fixes; one even addressed a long-standing zero-day vulnerability. This research not only sheds light on the capabilities and limitations of LLMs in enhancing web security but also paves the way for their practical application in addressing BAC issues, ultimately helping developers better safeguard their applications against security threats.