  APIs often transmit far more data to client applications than they need, and
in the context of web applications, often do so over public channels. This
issue, termed Excessive Data Exposure (EDE), was OWASP's third most significant
API vulnerability of 2019. However, there are few automated tools -- either in
research or industry -- to effectively find and remediate such issues. This is
unsurprising as the problem lacks an explicit test oracle: the vulnerability
does not manifest through explicit abnormal behaviours (e.g., program crashes
or memory access violations). In this work, we develop a metamorphic relation
to tackle that challenge and build the first fuzzing tool -- that we call
EDEFuzz -- to systematically detect EDEs. EDEFuzz can significantly reduce
false negatives that occur during manual inspection and ad-hoc text-matching
techniques, the current most-used approaches. We tested EDEFuzz against the
sixty-nine applicable targets from the Alexa Top-200 and found 33,365 potential
leaks -- illustrating our tool's broad applicability and scalability. In a
more-tightly controlled experiment of eight popular websites in Australia,
EDEFuzz achieved a high true positive rate of 98.65% with minimal
configuration, illustrating our tool's accuracy and efficiency.
