一句话：提出 EDEFuzz，用模糊测试自动发现 Web API 中的过度数据暴露问题
API 常向客户端返回远超其所需的数据，在 Web 应用中还常经公开信道传输，这类问题被称为过度数据暴露（Excessive Data Exposure, EDE），被 OWASP 列为 2019 年第三大 API 安全风险。其关键困难在于缺少显式测试预言：该漏洞不会像程序崩溃或内存访问违规那样表现为异常行为，因此研究和工业界都很少有自动化工具能有效发现并修复它。本文提出 EDEFuzz，一个面向 Web API 的模糊测试器，旨在自动发现 EDE。摘要未报告具体实现细节与实验结果。
APIs often transmit far more data to client applications than they need, and in the context of web applications, often do so over public channels. This issue, termed Excessive Data Exposure (EDE), was OWASP's third most significant API vulnerability of 2019. However, there are few automated tools---either in research or industry---to effectively find and remediate such issues. This is unsurprising as the problem lacks an explicit test oracle: the vulnerability does not manifest through explicit abnormal behaviours (e.g., program crashes or memory access violations).
DOI 原文 ·
@inproceedings{paperbot11381,
title = {EDEFuzz: A Web API Fuzzer for Excessive Data Exposures},
author = {Lianglu Pan and Shaanan Cohney and Toby Murray and Van-Thuan Pham},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3608133}
}