API2:2023 Broken Authentication - OWASP API Security Top 10

Overview

API2:2023 Broken Authentication is a security vulnerability in APIs that can be exploited by attackers to gain unauthorized access to user accounts. This vulnerability is common and easy to detect, and it can have severe technical and business-specific impacts.

Description

API2:2023 Broken Authentication refers to the vulnerability in the authentication mechanism of an API. It is an easy target for attackers as it is often exposed to everyone. While exploiting this vulnerability may require advanced technical skills, there are readily available tools for attackers to do so. The prevalent misconception among software and security engineers regarding authentication boundaries and implementation complexity contributes to the common occurrence of this vulnerability. Attackers can exploit broken authentication to gain complete control of other users' accounts, read their personal data, and perform sensitive actions on their behalf. It is difficult for systems to distinguish between attackers' actions and legitimate user actions.

How to Prevent ?

To prevent API2:2023 Broken Authentication vulnerability, it is important to: 1. Understand and implement proper authentication mechanisms. Don't reinvent the wheel and use standard practices such as OAuth for authentication. 2. Treat authentication endpoints and 'Forgot password / reset password' mechanisms with the same level of security. 3. Implement rate limiting and lockout mechanisms to prevent brute force attacks and credential stuffing. 4. Use strong passwords, validate token authenticity, and do not send sensitive authentication details in URLs. 5. Implement multi-factor authentication and anti-brute force mechanisms. 6. Avoid using API keys for user authentication.

Example Attack Scenarios:

• Scenario #1 - Brute Force Log In:  In this scenario, an attacker levers GraphQL query batching to bypass rate limiting and performs a brute force attack by trying different username/password combinations. By exploiting the broken authentication vulnerability, the attacker can gain unauthorized access to user accounts.

• Scenario #2 - Account Takeover:  In this scenario, an attacker updates the email address associated with a user's account without requiring password confirmation. By doing so, the attacker can steal the authentication token and initiate the reset password workflow, giving them control over the victim's account.