BOLABuster: Harnessing LLMs for Automating BOLA Detection

The Challenge of Automated BOLA Detection

Broken Object Level Authorization (BOLA) consistently ranks among the most critical API security flaws. Automated scanning for BOLA has traditionally been difficult because detecting authorization bypasses requires understanding stateful business logic and endpoint dependencies.

BOLABuster Architecture and LLM Integration

BOLABuster uses large language models to analyze API documentation and traffic flows, infer object relationships, generate context-aware test cases, and validate unauthorized access responses across user sessions.

Real-World Discoveries in Open Source

Testing BOLABuster against popular open-source platforms uncovered multiple critical vulnerabilities, including fifteen CVEs in a single project and CVE-2024-1313 in Grafana.