Exploring Permission Control Flaws in Mini-apps

Mini-apps, running within super apps like WeChat, Snapchat, Telegram, etc., have become quite popular these years, expanding the capability of super apps to offer almost any functionality users might desire in their daily lives. However, developers of both super apps and mini-apps typically focus on functionality, thus overlooking security measures essential for protecting users’ sensitive information and safeguarding critical operations. In this paper, we utilize a static analysis approach, revealing two major security flaws of mini-apps and super apps: users’ sensitive information leakage and caller impersonation attacks. We analyzed 10,000 popular mini-apps on WeChat and found that 2,554 are vulnerable to the users’ sensitive information leakage. For the caller impersonation attack, we found one example that is vulnerable to such an attack.