Cloud Data Leakage Detection in WeChat Mini-Programs Based on Static and Dynamic Analysis

Since the launch of WeChat mini-programs in 2017, their rapid development has enabled users to perform various functions, such as payments and shopping, without leaving the main WeChat application. Concurrently, with the widespread adoption of cloud computing, an increasing number of mini-programs are utilizing these technologies to optimize performance and scalability. In cloud environments, cloud credentials are crucial for accessing and managing cloud resources, playing a key role in ensuring data integrity and system security. However, the prevalence and severity of cloud credential leaks in mini-programs have not garnered sufficient academic research and attention. To address this issue, this paper proposes an automated detection scheme that combines static and dynamic analysis to systematically identify cloud credential leaks in WeChat mini-programs. By analyzing 1,584 collected WeChat mini-programs, we identified 36 instances of cloud credential leaks across 34 programs, involving credentials from Alibaba Cloud and Tencent Cloud, 23 of which posed significant security risks. The leaked credentials exposed a range of sensitive information, including personal data and corporate confidential information. We have responsibly reported these vulnerabilities to developers and relevant authorities, and provided security recommendations aimed at mitigating the risks of cloud credential leakage.