API10:2023 Unsafe Consumption of APIs - OWASP API Security Top 10

Overview

Unsafe consumption of APIs is a critical security risk that can lead to unauthorized access, data exposure, and other types of attacks. This article provides an overview of the API Security Top 10, specifically focusing on API10:2023 - Unsafe Consumption of APIs.

Description

Developers tend to trust data received from third-party APIs more than user input, which can lead to security vulnerabilities. This article explains the security weakness associated with unsafe consumption of APIs and its impact on businesses. It also provides example attack scenarios to demonstrate how attackers can exploit this vulnerability. Additionally, it offers preventive measures to mitigate the risk of unsafe API consumption.

How to Prevent ?

To prevent unsafe consumption of APIs, it is crucial to assess the security posture of service providers and ensure that all API interactions occur over a secure communication channel. Developers should always validate and sanitize data received from integrated APIs and maintain an allowlist of well-known locations to avoid blindly following redirects. Further recommendations can be found in the references section of this article.

Example Attack Scenarios:

• Scenario #1:  In this scenario, an API relies on a third-party service to enrich user-provided business addresses. Attackers exploit the vulnerability by storing an SQL injection payload associated with a malicious business in the third-party service. When the API pulls this data, the SQL injection payload is executed, leading to data exfiltration.

• Scenario #2:  In this scenario, an API integrates with a third-party service provider to store sensitive user medical information. Attackers compromise the third-party API to redirect requests containing sensitive data to their controlled server. The API blindly follows the redirects, unintentionally sending the data to the attackers.

• Scenario #3:  In this scenario, an attacker prepares a malicious git repository with an SQL injection payload. When an application integrates with this repository, the SQL injection payload is executed on the application that assumes the repository's name is safe input. This can lead to data breaches and unauthorized access.