OWASP API Top 10

  • The OWASP API Security Top 10 is a list of the most common API security problems that organizations face. The list was created by the Open Web Application Security Project (OWASP) a non-profit organization that promotes web application security.
  • The OWASP API Security Top 10 was first released in 2019 and was updated in 2023 to reflect the changing threat landscape and new attack vectors.

The list includes the following:

    1. Broken Object Level Authorization
    2. Broken Authentication
    3. Broken Object Property Level Authorization
    4. Unrestricted Resource Consumption
    5. Broken Function Level Authorization
    6. Unrestricted Access to Sensitive Business Flows
    7. Server-Side Request Forgery
    8. Security Misconfiguration
    9. Improper Inventory Management
    10. Unsafe Consumption of APIs

API1:2023 - Broken Object Level Authorization

  • APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues.
  • Object level authorization checks should be considered in every function that accesses a data source using an ID from the user.

API2:2023 - Broken Authentication

  • Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user’s identities temporarily or permanently.
  • Compromising a system’s ability to identify the client/user, compromises API security overall.

API3:2023 - Broken Object Property Level Authorization

  • This category combines API3:2019 Excessive Data Exposure and API6:2019 - Mass Assignment, focusing on the root cause: the lack of or improper authorization validation at the object property level.
  • This leads to information exposure or manipulation by unauthorized parties.

API4:2023 - Unrestricted Resource Consumption

  • Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage.
  • Other resources such as emails/SMS/phone calls or biometrics validation are made available by service providers via API integrations, and paid for per request.
  • Successful attacks can lead to Denial of Service or an increase of operational costs.

API5:2023 - Broken Function Level Authorization

  • Complex access control policies with different hierarchies, groups, and roles, and an unclear separation between administrative and regular functions, tend to lead to authorization flaws.
  • By exploiting these issues, attackers can gain access to other users’ resources and/or administrative functions.

API6:2023 - Unrestricted Access to Sensitive Business Flows

  • APIs vulnerable to this risk expose a business flow - such as buying a ticket, or posting a comment - without compensating for how the functionality could harm the business if used excessively in an automated manner.
  • This doesn’t necessarily come from implementation bugs.

API7:2023 - Server Side Request Forgery

  • Server-Side Request Forgery (SSRF) flaws can occur when an API is fetching a remote resource without validating the user-supplied URI.
  • This enables an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN.

API8:2023 - Security Misconfiguration

  • APIs and the systems supporting them typically contain complex configurations, meant to make the APIs more customizable.
  • Software and DevOps engineers can miss these configurations, or don’t follow security best practices when it comes to configuration, opening the door for different types of attacks.

API9:2023 - Improper Inventory Management

  • APIs tend to expose more endpoints than traditional web applications, making proper and updated documentation highly important.
  • A proper inventory of hosts and deployed API versions also are important to mitigate issues such as deprecated API versions and exposed debug endpoints.

API10:2023 - Unsafe Consumption of APIs

  • Developers tend to trust data received from third-party APIs more than user input, and so tend to adopt weaker security standards.
  • In order to compromise APIs, attackers go after integrated third-party services instead of trying to compromise the target API directly.

OWASP’s API Security Risks Ratings

API NoVulnerabilityExploitabilityPrevalenceDetectabilityImpacts
API-1Broken Object Level AuthorizationEasyWidespreadEasyModerate
API-2Broken AuthenticationEasyCommonEasySevere
API-3Broken Object Property Level AuthorizationEasyCommonEasyModerate
API-4Unrestricted Resource ConsumptionAverageWidespreadEasySevere
API-5Broken Function Level AuthorizationEasyCommonEasySevere
API-6Unrestricted Access to Sensitive Business FlowsEasyWidespreadAverageModerate
API-7Server Side Request ForgeryEasyCommonEasyModerate
API-8Security MisconfigurationEasyWidespreadEasySevere
API-9Improper Inventory ManagementEasyWidespreadAverageModerate
API-10Unsafe Consumption of APIsEasyCommonAverageSevere

OWASP Top 10 APIs 2019 vs 2023

Akto’s Blog Infographic OWASP Top 10 APIs 2019 vs 2023

Why is it important?

  • The OWASP API Security Top 10 is important for bug bounty hunters because it provides a framework for identifying and mitigating API security risks.
  • Knowing these 10 security risks will help bug bounty hunters get an idea of what to look for while auditing API applications.
  • The list serves as a standard awareness document for software development of the security issues they need to address.

References

  1. OWASP API Security Project
  2. OWASP API Security Project’s GitHub
  3. OWASP API Security Top 10 Project Webpage
  4. Salt Security’s Blog | API Security 101
  5. Salt Security’s Blog | API Security Top 10 Explained
  6. OWASP API Security Top 10 2023 and GraphQL | Postman Blog