Raising the Flag: Detecting Missing Permission Controls in Mini-Program APIs

Mini-programs embedded within super-apps like WeChat have surged in popularity due to their flexibility and convenience, offering rich functionalities through underlying APIs. However, this tight integration introduces serious security risks: mini-programs often inherit the mobile operating system's permissions granted to their host super-app, potentially bypassing critical security checks. In this paper, we address the urgent need for more fine-grained access control tailored to mini-programs. We propose PERMSCOPE, a systematic framework to detect and analyze missing scope checks in mini-program APIs, revealing instances where Android permissions are implicitly inherited and exercised in mini-program APIs, i.e., cases where "ask and check'' primitives are absent. Our empirical analysis of four major super-apps reveals that 183 (8.85%) APIs are not properly protected at the mini-program API layer. We discuss the challenges underlying this issue and advocate for super-app developers to enforce fine-grained access control mechanisms at the API boundary, thereby strengthening the trustworthiness of the mobile super-app ecosystem.