[Paper Review] foREST: A Tree-based Approach for Fuzzing RESTful APIs

Jiaxian Lin, Tianyu Li+5 more|arXiv (Cornell University)|Mar 6, 2022

Software System Performance and Reliability4 citations

TL;DR

This paper proposes foREST, a novel tree-based approach for fuzzing RESTful APIs that models endpoint hierarchies to improve dependency modeling efficiency. By constructing API trees from OpenAPI/Swagger specifications and traversing them in pre-order, foREST reduces dependency complexity from quadratic to linear, achieving 11.5% to 82.5% higher code coverage than EvoMaster and RESTler while uncovering 11 new bugs in real-world services.

ABSTRACT

Representational state transfer (REST) is a widely employed architecture by web applications and cloud. Users can invoke such services according to the specification of their application interfaces, namely RESTful APIs. Existing approaches for fuzzing RESTful APIs are generally based on classic API-dependency graphs. However, such dependencies are inefficient for REST services due to the explosion of dependencies among APIs. In this paper, we propose a novel tree-based approach that can better capture the essential dependencies and largely improve the efficiency of RESTful API fuzzing. In particular, the hierarchical information of the endpoints across multiple APIs enables us to construct an API tree, and the relationships of tree nodes can indicate the priority of resource dependencies, extit{e.g.,} it's more likely that a node depends on its parent node rather than its offspring or siblings. In the evaluation part, we first confirm that such a tree-based approach is more efficient than traditional graph-based approaches. We then apply our tool to fuzz two real-world RESTful services and compare the performance with two state-of-the-art tools, EvoMaster and RESTler. Our results show that foREST can improve the code coverage in all experiments, ranging from 11.5\% to 82.5\%. Besides, our tool finds 11 new bugs previously unknown.

Motivation & Objective

• To address the inefficiency of graph-based dependency modeling in REST API fuzzing, which suffers from exponential growth in API dependencies.
• To improve the accuracy and efficiency of generating valid, diverse test cases by modeling hierarchical relationships between API endpoints.
• To reduce the complexity of dependency traversal from O(n²) in graphs to O(n) in trees, enabling faster and more scalable fuzzing.
• To enhance resource management and request sequence generation through tree traversal and dynamic dependency evaluation.
• To evaluate the approach on real-world services and compare it with state-of-the-art tools like RESTler and EvoMaster.

Proposed method

• Parse OpenAPI/Swagger specifications to extract endpoint URLs and construct hierarchical trees by splitting URLs at the '/' delimiter.
• Represent each URL segment as a node in a tree, with edges forming paths from root to leaf nodes, capturing endpoint hierarchy.
• Assign each node attributes for supported HTTP methods and maintain a buffer for stored resources to support stateful testing.
• Use a template-based request order strategy: pre-order traversal with GET first, followed by multiple POSTs, then PUT and DELETE to preserve resources for descendants.
• Apply dynamic dependency pair evaluation to prioritize parent-node dependencies over siblings or descendants, improving validity of generated requests.
• Iteratively traverse all trees in a service to handle multiple endpoint hierarchies, maintaining linear time complexity with respect to the number of APIs.

Experimental results

Research questions

• RQ1 Can a tree-based model reduce the complexity of API dependency modeling compared to traditional graph-based approaches?
• RQ2 Does modeling endpoint hierarchies improve the efficiency and validity of test case generation in REST API fuzzing?
• RQ3 To what extent does the tree-based approach outperform graph-based methods in terms of code coverage and bug detection?
• RQ4 How does foREST compare to state-of-the-art tools like RESTler and EvoMaster in real-world fuzzing scenarios?
• RQ5 Can the tree-based approach effectively handle complex, multi-hierarchical REST API structures while maintaining high code coverage?

Key findings

• The tree-based approach significantly reduces dependency complexity from O(n²) in graphs to O(n) in trees, improving traversal efficiency.
• foREST achieved higher code coverage than both EvoMaster and RESTler across all experiments, with improvements ranging from 11.5% to 82.5%.
• In fuzzing WordPress and GitLab, foREST discovered 11 previously unknown bugs, demonstrating its effectiveness in real-world vulnerability detection.
• The pre-order traversal strategy with prioritized parent dependencies increased the likelihood of generating valid, stateful test sequences.
• The prototype implementation of foREST successfully handled multiple endpoint trees and maintained linear scalability with respect to the number of APIs.
• Compared to graph-based methods, the tree-based model produced more accurate dependency relationships, reducing invalid or redundant request paths.