一句话：首个针对 DeepLink 攻击的自动利用生成框架，用 LLM 求解路由约束并变异可信域名绕过白名单防御。
现代移动应用普遍嵌入 WebView，而 WebView 加载 URL 的输入校验不足可危及整个应用乃至系统。其中 DeepLink 攻击最为关键，往往只需用户一次点击即可触发；尽管已有 URL 白名单等防御，配置错误与实现不一致仍使应用暴露于利用风险，且缺乏自动化利用生成手段。本文提出 DeepExploitor，首个面向 DeepLink 可利用漏洞的自动利用生成框架，解决两大挑战：一是通过抽取约束相关代码并借助大语言模型求解，静态建模应用特有的复杂路由封装与自定义输入解析逻辑，从而可扩展地发现有效利用；二是识别并变异应用中内嵌的可信域名，以绕过基于域名的黑盒白名单防御。作者在 433 个最流行的 Android 应用上评估该系统，共发现 83 个零日漏洞，其中 24 个被评为高危或严重级别；所有发现均已负责任地披露给厂商，目前 35 个得到确认或被分配 CVE/CNVD 编号。
Modern mobile apps widely embed WebView to enable rich and dynamic content, making it an increasingly attractive target for attackers. It is well known that insufficient or improper input validation on WebView-loaded URLs can compromise the entire app or even the underlying system. Among these threats, one of the most critical attack vectors is the DeepLink Attack, which often requires only a single user click to exploit WebView vulnerabilities. Despite the deployment of defense such as URL allowlists, misconfigurations and inconsistent implementations continue to expose apps to exploitation.In this paper, we present DeepExploitor, the first automated exploit generation framework targeting vulnerabilities exploitable via DeepLink Attack. DeepExploitor addresses two key challenges: First, it statically models complex, app-specific routing encapsulation and customized input parsing logic by extracing constraint-related code and resolving them through large language models (LLMs), enabling scalable discovery of valid exploits. Second, it identifies and mutates trusted domains embedded in the app to bypass black-box defenses such as domain-based allowlists. We evaluated DeepExploitor on 433 of the most popular Android apps and uncovered 83 zero-day vulnerabilities, including 24 rated as high or critical severity. All findings were responsibly disclosed to affected vendors, with 35 acknowledged to date or assigned CVE/CNVD identifiers.
DOI 原文 ·
@inproceedings{paperbot9297,
title = {DeepExploitor: LLM-Enhanced Automated Exploitation of DeepLink Attack in Hybrid Apps},
author = {Zhangyue Zhang and Lei Zhang and Zhibo Zhang and Yongheng Liu and Zhemin Yang and Yuan Zhang and Min Yang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00199}
}