Papers › GraphQLer: Enhancing GraphQL Security with Context-Aware API Testing
GraphQLer: Enhancing GraphQL Security with Context-Aware API Testing
Omar Tsai, Jianing Li, Tsz Tung Cheung, Lejing Huang, Hao Zhu, Jianrui Xiao, Iman Sharafaldin, Mohammad A. Tayebi
The archive published only this paper's code-link row. Authors, date and abstract are from arXiv's metadata (CC0), read from the Kaggle arXiv metadata snapshot of 2026-09-12 where its title matched the archive's; the title is the archive's.
GraphQL APIs power production systems across financial services, e-commerce, and social platforms, yet their most critical access-control vulnerabilities--Insecure Direct Object Reference (IDOR), Use-After-Free (UAF), and state-dependent injection--routinely escape automated security testing. Industry-standard scanners (ZAP) and the leading research fuzzer (EvoMaster) test operations in isolation and cannot compose the multi-step sequences these flaws require. We present GraphQLer, an open-source automated security testing framework built for production GraphQL APIs. GraphQLer constructs a typed dependency graph from live schema introspection and synthesizes vulnerability chains--ordered operation sequences targeting specific flaw classes. Three strategies cover the critical attack surface: topological SCC-traversal for general reachability, cross-user IDOR replay for broken access control, and CREATE -> DELETE -> READ synthesis for UAF. On a production financial API (FinServ), GraphQLer identified eight potential vulnerabilities--including denial-of-service vectors that exposed stack traces and sensitive implementation details--without prior documentation or authentication credentials. On a self-hosted Saleor instance pinned to the CVE-2022-39275 commit, GraphQLer reproduced all four broken-access-control mutations cited in the security advisory. On the 11 public APIs of the coverage set, GraphQLer achieves 85.52% mean PositiveCoverage versus 29.29% (EvoMaster) and 21.80% (ZAP); across the 21 evaluated APIs it detects all 5 confirmed IDOR endpoints, UAF behavior on two controlled schemas, and confirms XSS and SQLi on DVGA (an independent third-party oracle)--while all baselines detect zero chain-based vulnerabilities.
Code
Repository list and official/mentioned flags are the archive's, frozen 2025-07-28. Reachability, where shown, is from one Syntology probe window (2026-09-16 to 2026-09-18); repositories not probed show nothing. GitHub stars are not tracked.
Code Syntology ran Syntology
Not run by Syntology. Nothing on this page verifies that the listed code works.
Results from the paper archive 2025-07-28
No leaderboard rows for this paper in the archive.
Report a problem or propose a change · a person checks every report against the paper or source before anything changes; decisions are listed on /corrections