kirancodes.me
To Proof Maintenance & Beyond!
ICSE 2024★ Distinguished Paper

EDEFuzz: A Web API Fuzzer for Excessive Data Exposures

Lianglu Pan, Shaanan Cohney, Toby Murray, Van-Thuan Pham

PDFDOI 10.1145/3597503.3608133dblp

Abstract

APIs often transmit far more data to client applications than they need, and in the context of web applications, often do so over public channels. This issue, termed Excessive Data Exposure (EDE), was OWASP's third most significant API vulnerability of 2019. However, there are few automated tools---either in research or industry---to effectively find and remediate such issues. This is unsurprising as the problem lacks an explicit test oracle: the vulnerability does not manifest through explicit abnormal behaviours (e.g., program crashes or memory access violations).

BibTeX
@inproceedings{Pan-al:ICSE24,
  author    = {Lianglu Pan and
               Shaanan Cohney and
               Toby Murray and
               Van{-}Thuan Pham},
  title     = {{EDEFuzz:} A Web {API} Fuzzer for Excessive Data Exposures},
  booktitle = {ICSE},
  pages     = {45:1--45:12},
  publisher = {{ACM}},
  year      = {2024},
}

Related papers