💻 computer science

GraphQLer: Enhancing GraphQL Security with Context-Aware API Testing

GraphQLer is an open-source automated security testing framework that enhances GraphQL API security by constructing typed dependency graphs from live schemas to synthesize multi-step vulnerability chains, thereby outperforming existing tools like ZAP and EvoMaster in detecting complex, state-dependent flaws such as IDOR, UAF, and injection vulnerabilities.

Original authors: Omar Tsai, Jianing Li, Tsz Tung Cheung, Lejing Huang, Hao Zhu, Jianrui Xiao, Iman Sharafaldin, Mohammad A. Tayebi

Published 2026-08-05

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Omar Tsai, Jianing Li, Tsz Tung Cheung, Lejing Huang, Hao Zhu, Jianrui Xiao, Iman Sharafaldin, Mohammad A. Tayebi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling city where different computer programs (apps) constantly talk to each other to share information. For years, these conversations followed a strict, predictable map: if you wanted a picture, you asked for the "picture" folder; if you wanted a message, you asked for the "message" folder. This was like ordering from a menu where every dish has a fixed name and location. But recently, a new way of talking called GraphQL became popular. Instead of a fixed menu, GraphQL is like a magical, shape-shifting vending machine. You can ask for exactly what you want, and it will try to build it for you on the spot. The problem is that because this machine is so flexible, it sometimes forgets to check who is standing in front of it. A regular vending machine might only give a soda to someone with a coin, but this magical one might accidentally hand out a private diary or a bank account if you ask the right way. This is where security researchers come in, trying to figure out how to trick the machine into revealing its secrets without actually breaking the city down.

The paper you're about to read introduces a new digital detective named GraphQLer. Think of most security scanners as clumsy tourists who walk up to the vending machine, press one random button, and see what happens. If they press "Soda" and get a soda, they move on. If they press "Water" and get an error, they give up. They never realize that to get the "Secret Stash," you first have to press "Buy Soda," then "Get Receipt," and then press "Secret Stash." The old tools are too dumb to connect the dots; they test every button in isolation and miss the complex sequences required to break the system.

GraphQLer is different. It's like a detective who first studies the machine's blueprints (the "schema") to understand how the buttons are connected. It builds a mental map showing that "Button A" creates a new item, "Button B" deletes it, and "Button C" might still be able to see it even after it's gone. With this map, GraphQLer doesn't just press buttons randomly; it creates specific chains of actions. It simulates a scenario where a user buys an item, then tries to steal it, or deletes it and then tries to read it again.

The researchers tested this new detective on 21 different real-world and fake-but-realistic APIs (the computer systems being tested). They found that GraphQLer was a massive improvement over the old tools. While the best existing tools could only successfully reach about 29% of the machine's buttons, GraphQLer managed to reach 85.52% of them. More importantly, when it came to finding the tricky security holes, the old tools found zero of the complex, multi-step problems. GraphQLer, however, found all five confirmed "IDOR" vulnerabilities (where you can see someone else's stuff just by changing a number) and even caught a "Use-After-Free" bug (where you can see a file after it's been deleted).

In a real-world test on a financial system (which the authors call "FinServ" to keep it anonymous), GraphQLer found eight potential security flaws without needing any passwords or secret documents. It even found ways to make the system crash and reveal its internal code, which is a big no-no for security. The paper also showed that GraphQLer could reproduce known vulnerabilities in a popular open-source platform called Saleor, proving it works on systems that are already known to be broken.

The authors are very careful to say that while their tool is excellent at finding these specific types of chain-reaction bugs, it's not a magic wand that solves everything. It still struggles with some very specific, complex scenarios where the machine requires multiple pieces of information at once to work. But for the vast majority of modern apps that use this flexible GraphQL technology, GraphQLer proves that you can't just test buttons one by one anymore. You have to understand the story the machine is telling, and only then can you find where the plot holes are.

Technical Summary: GraphQLer

Problem Statement

GraphQL APIs have become dominant in production systems due to their schema-driven, single-endpoint design. However, this architecture introduces unique security challenges absent in REST APIs. Unlike REST, where HTTP verbs and URL structures encode intent, GraphQL exposes all operations through a single endpoint with no built-in access-control enforcement.

The paper identifies that critical access-control vulnerabilities—specifically Insecure Direct Object Reference (IDOR), Use-After-Free (UAF), and state-dependent injection—routinely escape automated security testing. Existing industry-standard scanners (e.g., ZAP) and research fuzzers (e.g., EvoMaster) test operations in isolation. They fail to model the stateful dependency structure of GraphQL, where a mutation may silently depend on resources created by earlier operations. Consequently, vulnerabilities that require multi-step sequences (e.g., creating a resource as User A, then accessing it as User B) are invisible to tools that cannot compose operation chains.

Methodology

The authors present GraphQLer, an open-source automated security testing framework designed to treat vulnerability chains (ordered operation sequences) as first-class constructs. The framework operates in two primary phases:

1. Compilation Phase

GraphQLer parses the live schema via introspection to construct a typed dependency graph.

Action Annotation: It infers mutation semantics (CREATE, UPDATE, DELETE, or UNKNOWN) by analyzing names and descriptions. Ambiguous cases can be resolved via an optional LLM-based resolver.
Dependency Inference: Since GraphQL does not explicitly expose input dependencies in machine-readable form, GraphQLer infers edges by matching ID-typed input fields to object types using name-pattern derivation and Levenshtein distance scoring.
Graph Construction: The system creates nodes for queries, mutations, and object types, linking them via directed edges representing hard (non-nullable) and soft (nullable) dependencies.

2. Testing Phase

The testing phase traverses the dependency graph using a three-pass strategy (CREATE/Queries $\rightarrow$ UPDATE $\rightarrow$ DELETE) and materializes payloads.

Payload Materialization: It generates valid payloads (minimally and maximally valid) and fuzzed payloads (injecting SQLi, XSS, OS command, etc.). It maintains an objects bucket to store returned resources (IDs, state) for reuse in subsequent operations.
Vulnerability Chain Strategies: GraphQLer employs three specialized strategies to synthesize specific attack sequences:
1. Topological Chain Strategy: Uses Strongly Connected Component (SCC) condensation to handle cyclic graphs, ensuring a valid execution order for general reachability.
2. IDOR Chain Strategy: Takes regular chains and replays them with a "primary" user credential for the CREATE step and a "secondary" (unprivileged) user credential for subsequent steps. A vulnerability is flagged if the secondary user accesses a resource they should not.
3. UAF Chain Strategy: Synthesizes chains where a resource is created, deleted, and then read. It searches for quadruples $(c, o, d, r)$ where $c$ is CREATE, $d$ is DELETE, and $r$ is READ. If the READ step returns data after the DELETE, a UAF vulnerability is detected.

The framework also supports WebSocket-based subscriptions and exposes its pipeline as a Model Context Protocol (MCP) server for AI-assisted workflows.

Key Contributions

Vulnerability Chains: The introduction of ordered GraphQL operation sequences as a primary testing construct, specifically designed to detect multi-step vulnerabilities missed by single-operation tools.
Three Specialized Strategies: Implementation of topological SCC-traversal, cross-user IDOR replay, and UAF graph-edge synthesis to cover critical attack surfaces.
GraphQLer Tool: An open-source implementation featuring a dependency graph, an injection suite covering nine vulnerability categories, an LLM-assisted dependency resolver, and a multi-auth profile engine.
Extensive Evaluation: Evaluation across 21 APIs, including public APIs, production platform APIs, known-vulnerable applications (Saleor, DVGA), and purpose-built ground-truth APIs.

Results

The evaluation demonstrates that GraphQLer significantly outperforms existing tools in both coverage and vulnerability detection:

Operation Coverage: On 11 public APIs, GraphQLer achieved a mean PositiveCoverage of 85.52%, compared to 29.29% for EvoMaster and 21.80% for ZAP.
Ground-Truth Detection:
- IDOR: Detected all 5 confirmed IDOR endpoints on a purpose-built API.
- UAF: Detected UAF behavior on the VVSM-API and incidentally on the IDOR-API.
- Injection: Confirmed SQLi, XSS, and OS command injection on purpose-built APIs and independently validated XSS and SQLi on the third-party DVGA application.
- Baseline Comparison: All baseline tools (ZAP, EvoMaster, Schemathesis, GraphQL-Cop) detected zero chain-based vulnerabilities (IDOR or UAF).
Real-World Application: On a production financial API (FinServ), GraphQLer identified eight potential vulnerabilities, including denial-of-service vectors exposing stack traces, without prior documentation or credentials. On a Saleor instance pinned to CVE-2022-39275, it reproduced all four broken-access-control mutations cited in the security advisory.

Significance and Claims

The paper claims that GraphQLer addresses a structural gap in automated security testing: the inability of existing tools to model stateful, multi-step dependencies in GraphQL. By synthesizing vulnerability chains, GraphQLer exposes flaws that are invisible to single-operation fuzzers.

The authors position GraphQLer not just as a scanner, but as a tool for industrial triage and evidence collection, capable of operating in a fully black-box manner to identify high-risk vectors in production systems. The work highlights that while single-operation tools can verify schema conformance, they are architecturally incapable of detecting vulnerabilities that rely on the sequence and state of operations. The release of ground-truth APIs (IDOR-API, Injection-API, VVSM-API) is intended to provide the first labeled benchmarks for chain-based GraphQL vulnerability detection.

The paper remains modest regarding limitations, acknowledging that certain complex preconditions (e.g., multi-field authentication for injection) and scalar materialization issues can still lead to false negatives, and that independent external validation of IDOR/UAF on large-scale third-party applications remains future work.