Publish/subscribe protocols are widely adopted in IoT and distributed systems. Brokers mediate message delivery among multiple participants, acting as convergence points for complex multi-party dependencies and protocol states. As a result, flaws in broker implementations can compromise the security and stability of entire systems. Although fuzzing has proven effective for bug discovery, most existing fuzzers adopt a two-party model, which limits their ability to explore multi-party communication logic. Moreover, existing fuzzers typically focus on either memory corruption or logic errors without considering whether a broker implementation is specification-compliant. In this paper, we present PSFuzzer, a multi-party black-box fuzzer designed for pub/sub protocols. PSFuzzer employs a multiparty fuzzing framework with two concurrent senders to systematically explore multi-party interactions. We propose a unified intermediate representation for multi-party message transmission and introduce an LLM-driven dependency extraction approach to automatically extract multi-party dependency rules for various protocols. Guided by these rules, PSFuzzer coordinates concurrent message sending and combines random exploration with a message-priority scheduling strategy to improve fuzzing efficiency. To detect protocol non-compliance bugs, PSFuzzer leverages differential testing and an LLM-based analyzer to automatically validate and localize specification violations. We implemented PSFuzzer and evaluated it on 14 brokers across three categories of pub/sub protocols. PSFuzzer discovered 157 bugs, including 29 memory bugs and 128 non-compliance bugs, with 26 CVEs assigned. The comparison with state-of-the-art fuzzers indicates that PSFuzzer outperforms them in both code coverage and bug finding capabilities.
原文链接
分享
引用
