  IoT devices are currently facing continuous malicious attacks due to their
widespread use. Among these IoT devices, web vulnerabilities are also widely
exploited because of their inherent characteristics, such as improper
permission controls and insecure interfaces. Recently, the embedded system web
interface framework has become highly diverse, and specific vulnerabilities can
arise if developers forget to detect user input parameters or if the detection
process is not strict enough. Therefore, discovering vulnerabilities in the web
interfaces of IoT devices accurately and comprehensively through an automated
method is a major challenge. This paper aims to work out the challenge. We have
developed an automated vulnerability detection system called LuaTaint for the
typical web interface framework, LuCI. The system employs static taint analysis
to address web security issues on mobile terminal platforms to ensure detection
coverage. It integrates rules pertaining to page handler control logic within
the taint detection process to improve its extensibility. We also implemented a
post-processing step with the assistance of large language models to enhance
accuracy and reduce the need for manual analysis. We have created a prototype
of LuaTaint and tested it on 92 IoT firmwares from 8 well-known vendors.
LuaTaint has discovered 68 unknown vulnerabilities.
