Security

5 API Vulnerabilities That Get Exploited by Criminals

Let’s give a look at API vulnerabilities by reading the API Security Top 10 published by the Open Web Application Security Project (OWASP).

It’s no secret that cyber security has become a leading priority for most organizations — especially those in industries that handle sensitive customer information. And as these businesses work towards building robust security strategies, it’s vital that they account for various threat vectors and vulnerabilities.

One area that requires significant scrutiny is API security. APIs, short for application programming interfaces, have become a common building block for digitally enabled organizations. They facilitate communication as well as critical business operations, and they also support important digital transformations. It’s no surprise then that the average number of APIs per company increased 221% in the last year.

Crafting an API security strategy is a complex task. APIs have unique threat implications that aren’t fully solved by web application firewalls or identity and access management solutions. The first step to getting it right is to understand what the common vulnerabilities are.

5 Common API Vulnerabilities Explained

In its API Security Top 10, the Open Web Application Security Project (OWASP) identifies the top ten threats to APIs. Below, we take a closer look at some of the most common.

1. Broken Object Level Authentication (BOLA)

APIs with broken object level authentication allow attackers to easily exploit API endpoints by manipulating the ID of an object sent within an API request. The result? BOLA authorization flaws can lead to unauthorized viewing, modification or destruction of data, or even a full account takeover.

Today, BOLA accounts for 40% of all API attacks. One of the primary reasons they’re so prevalent is that traditional security controls like WAFs or API gateways can’t identify them as anomalous to the baseline API behavior. Instead, businesses need an API solution that can spot whenan authenticated user is trying to gain unauthorized access to another user’s data.

2. Broken User Authentication

There are a number of factors that can lead to broken user authentication in an API. This includes weak password complexity or poor password hygiene, missing account lockout thresholds, long durations for password or certificate rotations, or relying on API keys alone for authentication.

When an API experiences broken user authentication, cyber criminals can use authentication-related attacks like credential stuffing and brute-force attacks to gain access to applications. Once they’re in, the attackers can then take over user accounts, manipulate data, or make unauthorized transactions.

When it comes to traditional security methods, they often lack the ability to track traffic over time, meaning they can’t easily identify high-volume attacks like credential stuffing. As such, an API security solution should be able to identify abnormal behavior against a typical authentication sequence.

3. Excessive Data Exposure

A common issue with most APIs is that, for the sake of efficiency, they’re often set up to share more information than is needed in an API response. They then leave it to the client application to filter the information and render it for the user. This is problematic because attackers can use the redundant data to extract sensitive information from the API.

While some traditional security solutions can identify this type of vulnerability, they can’t always differentiate between legitimate data returned by the API and sensitive data that shouldn’t be returned. This means an API security solution should be able to spot when a user is consuming too much sensitive data.

4. Lack of Resources and Rate Limiting

APIs don’t always have restrictions for the number of resources that can be requested by the client or a user. This leaves them open to server disruptions that cause denial of service, as well as brute-force and enumeration attacks against APIs responsible for authentication and data fetching. Plus, attackers can set up automated attacks against APIs that don’t have limits, including credential cracking and token cracking.

Traditional solutions will have some basic rate limiting functionality, but it’s not always easy to deploy at scale. As such, these security tools often lack the context required to flag an attack when it’s happening. A modern API security solution should be able to identify any activity that falls outside of normal usage values.

5. Security Misconfiguration

There are a number of security misconfigurations that can accidentally introduce vulnerabilities into APIs. These include incomplete configurations, misconfigured HTTP headers, verbose error messages, open cloud storage, and more. Attackers can leverage these to learn more about the API components, and then exploit the misconfigurations as part of their attack.

Close the Gaps

Comprehensive API solutions can identify these misconfigurations and provide remediation suggestions.

Attackers are always evolving their strategies for compromising APIs, looking for new threat vectors and leveraging new vulnerabilities. What’s common in most successful attacks is that they target gaps in business logic. This means that to establish a proactive API security strategy, organizations must account for these gaps at every step.

About the Author: Ali Cameron is a content marketer that specializes in the cybersecurity and B2B SaaS space. Besides writing for Tripwire’s State of Security blog, she’s also written for brands including Okta, Salesforce, and Microsoft. Taking an unusual route into the world of content, Ali started her career as a management consultant at PwC where she sparked her interest in making complex concepts easy to understand. She blends this interest with a passion for storytelling, a combination that’s well suited for writing in the cybersecurity space. She is also a regular writer for Bora

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, API Vulnerabilities)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Cisco addressed high-severity flaws in IOS and IOS XE software

Cisco addressed multiple vulnerabilities in IOS and IOS XE software that can be exploited to…

10 hours ago

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…

17 hours ago

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

1 day ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

1 day ago

CISA adds Microsoft SharePoint bug disclosed at Pwn2Own to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint vulnerability disclosed at the…

2 days ago

The DDR Advantage: Real-Time Data Defense

This is the advantage of Data Detection and Response (DDR) for organizations aiming to build…

2 days ago

This website uses cookies.