Detection of Broken Access Control Vulnerability Using Graph Representation

Broken access control is still one of the most common vulnerabilities. This vulnerability can cause unauthorized information disclosure, modification, or destruction of all data or performing business function outside the user's limits. One method to detect broken access control is static code analysis. Various tools use different static code analysis techniques, mostly graph-based, such as finding vulnerability pattern using graph analysis, calculating graph similarity, graph embedding, and deep learning. Some of graphs that are commonly used are abstract syntax tree and control flow graph. However, there are several problems in existing tools such as framework-dependent and knowledge base that still depends on tool maker. This paper is aimed to develop static code analysis tool for Python code that utilize finding vulnerability pattern using graph analysis method. This tool allows users to add their own knowledge base, which is an advantage compared to existing tool. From the testing results on 16 projects, the tool has a recall value of 100% and a precision value of 63.24%. The recall value that reaches 100 % and the significant number of false positives occurred because the tool assumes that all detected code has a broken access control vulnerability by default until access control check is found.