MBFuzzer: A Multi-Party Protocol Fuzzer for MQTT Brokers

Xiangpu Song; Jianliang Wu; Yingpei Zeng; Hao Pan; Chaoshun Zuo; Qingchuan Zhao; Shanqing Guo

doi:10.5555/3766078.3766396

MBFuzzer: A Multi-Party Protocol Fuzzer for MQTT Brokers

Xiangpu Song
, Jianliang Wu^*
, Yingpei Zeng^*
, Hao Pan
, Chaoshun Zuo
, Qingchuan Zhao
, Shanqing Guo^*

^*Corresponding author for this work

Department of Computer Science

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

3 Citations (Scopus)

Abstract

MQTT is a multi-party communication protocol widely used in IoT environments, where MQTT brokers act as servers that connect with numerous devices. Consequently, any flaws in brokers will seriously impact all participants. Given the success of fuzzing techniques in finding bugs in programs, existing fuzzing works targeting MQTT brokers face the limitation of insufficient fuzzing input space because they all adopt a two-party fuzzing model. Accordingly, the code responsible for handling multi-party communication will not be examined. Moreover, existing fuzzers focus on either memory corruption bugs or logic errors without considering whether a broker implementation is specification-compliant.
In this paper, we design a black-box fuzzing approach, MBFuzzer, for brokers to address the above limitations. We first design a multi-party fuzzing framework containing two fuzzing input senders to facilitate the exploration of code space that handles multi-party communication. To improve fuzzing efficiency, we design a message priority scheduler, six dependency rules, and a dependency queue to guide test case generation and coordinate the message sending of the two senders, respectively. We leverage differential testing to identify non-compliance bugs and design an LLM-based noncompliance bug analysis method to automatically analyze the bug report and validate whether it is a non-compliance bug. We implemented a prototype MBFuzzer and evaluated it with six mainstream MQTT brokers. MBFuzzer successfully identified 73 bugs including 20 memory bugs and 53 non-compliance bugs with 11 CVEs assigned. The comparison with state-of-the-art fuzzers indicates that MBFuzzer outperforms them in both code coverage and bug finding capabilities.

© 2025 by The USENIX Association All Rights Reserved.

Original language	English
Title of host publication	SEC '25
Subtitle of host publication	Proceedings of the 34th USENIX Conference on Security Symposium
Publisher	USENIX Association
Pages	6179-6197
Number of pages	19
ISBN (Print)	978-1-939133-52-6
DOIs	https://doi.org/10.5555/3766078.3766396
Publication status	Published - 2025
Event	34th USENIX Security Symposium (USENIX Security 2025) - Seattle, United States Duration: 13 Aug 2025 → 15 Aug 2025

Publication series

Name	Proceedings of the USENIX Security Symposium

Conference

Conference	34th USENIX Security Symposium (USENIX Security 2025)
Abbreviated title	USENIX Security'25
Place	United States
City	Seattle
Period	13/08/25 → 15/08/25

Bibliographical note

Full text of this publication does not contain sufficient affiliation information. With consent from the author(s) concerned, the Research Unit(s) information for this record is based on the existing academic department affiliation of the author(s).

Funding

We thank anonymous reviewers for their comprehensive feedback. This work is supported by the National Natural Science Foundation of China (No. 62372268), the Major Scientific and Technological Innovation Projects of Shandong Province, China (No. 2024CXGC010114), and the Shandong Provincial Natural Science Foundation, China (No. ZR2022LZH013, No. ZR2021LZH007). It is also supported in part by the Zhejiang Provincial Natural Science Foundation of China (No. LY22F020022) and the National Natural Science Foundation of China (No. 61902098).

Access Output

10.5555/3766078.3766396

https://www.usenix.org/conference/usenixsecurity25/presentation/song-xiangpu

Other Access Options

Check CityUHK Library

Permanent Link

Right click to copy link

Cite this

@inproceedings{fa40c4d6a629407594371f21ff5cd62c,

title = "MBFuzzer: A Multi-Party Protocol Fuzzer for MQTT Brokers",

abstract = "MQTT is a multi-party communication protocol widely used in IoT environments, where MQTT brokers act as servers that connect with numerous devices. Consequently, any flaws in brokers will seriously impact all participants. Given the success of fuzzing techniques in finding bugs in programs, existing fuzzing works targeting MQTT brokers face the limitation of insufficient fuzzing input space because they all adopt a two-party fuzzing model. Accordingly, the code responsible for handling multi-party communication will not be examined. Moreover, existing fuzzers focus on either memory corruption bugs or logic errors without considering whether a broker implementation is specification-compliant. In this paper, we design a black-box fuzzing approach, MBFuzzer, for brokers to address the above limitations. We first design a multi-party fuzzing framework containing two fuzzing input senders to facilitate the exploration of code space that handles multi-party communication. To improve fuzzing efficiency, we design a message priority scheduler, six dependency rules, and a dependency queue to guide test case generation and coordinate the message sending of the two senders, respectively. We leverage differential testing to identify non-compliance bugs and design an LLM-based noncompliance bug analysis method to automatically analyze the bug report and validate whether it is a non-compliance bug. We implemented a prototype MBFuzzer and evaluated it with six mainstream MQTT brokers. MBFuzzer successfully identified 73 bugs including 20 memory bugs and 53 non-compliance bugs with 11 CVEs assigned. The comparison with state-of-the-art fuzzers indicates that MBFuzzer outperforms them in both code coverage and bug finding capabilities. {\textcopyright} 2025 by The USENIX Association All Rights Reserved.",

author = "Xiangpu Song and Jianliang Wu and Yingpei Zeng and Hao Pan and Chaoshun Zuo and Qingchuan Zhao and Shanqing Guo",

note = "Full text of this publication does not contain sufficient affiliation information. With consent from the author(s) concerned, the Research Unit(s) information for this record is based on the existing academic department affiliation of the author(s).; 34th USENIX Security Symposium (USENIX Security 2025), USENIX Security'25 ; Conference date: 13-08-2025 Through 15-08-2025",

year = "2025",

doi = "10.5555/3766078.3766396",

language = "English",

isbn = "978-1-939133-52-6",

series = "Proceedings of the USENIX Security Symposium",

publisher = "USENIX Association",

pages = "6179--6197",

booktitle = "SEC '25",

}

Song, X, Wu, J, Zeng, Y, Pan, H, Zuo, C, Zhao, Q & Guo, S 2025, MBFuzzer: A Multi-Party Protocol Fuzzer for MQTT Brokers. in SEC '25: Proceedings of the 34th USENIX Conference on Security Symposium. Proceedings of the USENIX Security Symposium, USENIX Association, pp. 6179-6197, 34th USENIX Security Symposium (USENIX Security 2025), Seattle, Washington, United States, 13/08/25. https://doi.org/10.5555/3766078.3766396

MBFuzzer: A Multi-Party Protocol Fuzzer for MQTT Brokers. / Song, Xiangpu; Wu, Jianliang; Zeng, Yingpei et al.
SEC '25: Proceedings of the 34th USENIX Conference on Security Symposium. USENIX Association, 2025. p. 6179-6197 (Proceedings of the USENIX Security Symposium).

Research output: Chapters, Conference Papers, Creative and Literary Works › RGC 32 - Refereed conference paper (with host publication) › peer-review

TY - GEN

T1 - MBFuzzer

T2 - 34th USENIX Security Symposium (USENIX Security 2025)

AU - Song, Xiangpu

AU - Wu, Jianliang

AU - Zeng, Yingpei

AU - Pan, Hao

AU - Zuo, Chaoshun

AU - Zhao, Qingchuan

AU - Guo, Shanqing

N1 - Full text of this publication does not contain sufficient affiliation information. With consent from the author(s) concerned, the Research Unit(s) information for this record is based on the existing academic department affiliation of the author(s).

PY - 2025

Y1 - 2025

N2 - MQTT is a multi-party communication protocol widely used in IoT environments, where MQTT brokers act as servers that connect with numerous devices. Consequently, any flaws in brokers will seriously impact all participants. Given the success of fuzzing techniques in finding bugs in programs, existing fuzzing works targeting MQTT brokers face the limitation of insufficient fuzzing input space because they all adopt a two-party fuzzing model. Accordingly, the code responsible for handling multi-party communication will not be examined. Moreover, existing fuzzers focus on either memory corruption bugs or logic errors without considering whether a broker implementation is specification-compliant. In this paper, we design a black-box fuzzing approach, MBFuzzer, for brokers to address the above limitations. We first design a multi-party fuzzing framework containing two fuzzing input senders to facilitate the exploration of code space that handles multi-party communication. To improve fuzzing efficiency, we design a message priority scheduler, six dependency rules, and a dependency queue to guide test case generation and coordinate the message sending of the two senders, respectively. We leverage differential testing to identify non-compliance bugs and design an LLM-based noncompliance bug analysis method to automatically analyze the bug report and validate whether it is a non-compliance bug. We implemented a prototype MBFuzzer and evaluated it with six mainstream MQTT brokers. MBFuzzer successfully identified 73 bugs including 20 memory bugs and 53 non-compliance bugs with 11 CVEs assigned. The comparison with state-of-the-art fuzzers indicates that MBFuzzer outperforms them in both code coverage and bug finding capabilities. © 2025 by The USENIX Association All Rights Reserved.

AB - MQTT is a multi-party communication protocol widely used in IoT environments, where MQTT brokers act as servers that connect with numerous devices. Consequently, any flaws in brokers will seriously impact all participants. Given the success of fuzzing techniques in finding bugs in programs, existing fuzzing works targeting MQTT brokers face the limitation of insufficient fuzzing input space because they all adopt a two-party fuzzing model. Accordingly, the code responsible for handling multi-party communication will not be examined. Moreover, existing fuzzers focus on either memory corruption bugs or logic errors without considering whether a broker implementation is specification-compliant. In this paper, we design a black-box fuzzing approach, MBFuzzer, for brokers to address the above limitations. We first design a multi-party fuzzing framework containing two fuzzing input senders to facilitate the exploration of code space that handles multi-party communication. To improve fuzzing efficiency, we design a message priority scheduler, six dependency rules, and a dependency queue to guide test case generation and coordinate the message sending of the two senders, respectively. We leverage differential testing to identify non-compliance bugs and design an LLM-based noncompliance bug analysis method to automatically analyze the bug report and validate whether it is a non-compliance bug. We implemented a prototype MBFuzzer and evaluated it with six mainstream MQTT brokers. MBFuzzer successfully identified 73 bugs including 20 memory bugs and 53 non-compliance bugs with 11 CVEs assigned. The comparison with state-of-the-art fuzzers indicates that MBFuzzer outperforms them in both code coverage and bug finding capabilities. © 2025 by The USENIX Association All Rights Reserved.

UR - https://www.scopus.com/pages/publications/105021308063

UR - https://www.scopus.com/record/pubmetrics.uri?eid=2-s2.0-105021308063&origin=recordpage

U2 - 10.5555/3766078.3766396

DO - 10.5555/3766078.3766396

M3 - RGC 32 - Refereed conference paper (with host publication)

SN - 978-1-939133-52-6

T3 - Proceedings of the USENIX Security Symposium

SP - 6179

EP - 6197

BT - SEC '25

PB - USENIX Association

Y2 - 13 August 2025 through 15 August 2025

ER -

MBFuzzer: A Multi-Party Protocol Fuzzer for MQTT Brokers

Abstract

Publication series

Conference

Bibliographical note

Funding

Access Output

Other Access Options

Permanent Link

Other Files and Links

Fingerprint

Cite this