Checking Security Properties of Cloud Services REST APIs - Atlidakis, Vaggelis; Godefroid, Patrice; Polishchuk, Marina (Microsoft, 2019)
Most modern cloud and web services are programmatically accessed through REST APIs. This paper discusses how an attacker might compromise a service by exploiting vulnerabilities in its REST API. We introduce four security rules that capture desirable properties of REST APIs and services. We then show how a stateful REST API fuzzer can be extended with active property checkers that automatically test and detect violations of these rules. We discuss how to implement such checkers efficiently and in a modular way. Thanks to these checkers, we found new bugs in several deployed production Azure and Office-365 cloud services, and we discuss their security implications.
Revised version published in ICST'2020, March 2020.