Mitigation of OWASP API Security Top 10 2023 using F5 Distributed Cloud Platform

The OWASP API Security project aims to help organizations by providing a guide with a list of the latest top 10 most critical API vulnerabilities and steps to mitigate them.

As part of updating the old OWASP API Security risk categories for 2019, the OWASP API Security Top 10 2023 is released.

 

List of vulnerabilities: 

API1:2023 Broken Object Level Authorization 

Broken Object Level Authorization (BOLA) is a vulnerability that occurs when there is a failure in validation of a user’s permissions to perform a specific task over an object, which may eventually lead to leakage, updation, or destruction of data. 

To prevent this vulnerability, proper authorization mechanisms should be followed, proper checks should be made to validate a user’s actions on a certain record, and security tests should be performed before deploying any production-grade changes. 

API2:2023 Broken Authentication 

Broken Authentication is a critical vulnerability that occurs when an application’s authentication endpoints fail to detect attackers impersonating someone else’s identity and allow partial or full control over the account. 

To prevent this vulnerability, observability and understanding of all possible authentication API endpoints is needed. Re-authentication should be performed for any confidential changes, multi-factor authentication, captcha-challenge, and effective security solutions should be applied to detect and mitigate credential stuffing, dictionary and brute-force types of attacks. 

Detailed explanation about the vulnerability with a demo showcasing the mitigation part using F5 Distributed Cloud can be found here 

API3:2023 Broken Object Property Level Authorization 

Broken Object Property Level Authorization is one of the new risk categories in the OWASP API Security Top 10 2023. This vulnerability occurs when a user is allowed to access an object’s property without validating their access permissions. 

Excessive Data Exposure and Mass Assignment which were initially a part of OWASP APISec 2019 are now part of this new vulnerability. 

To prevent this vulnerability, access privileges of users requesting for a specific object’s property should be scrutinized before exposure by the API endpoints. Use of generic methods and automatically binding client inputs to internal objects or code variables should be avoided and schema-based validation should be enforced. 

Detailed explanation about the vulnerabilities with demos showcasing the mitigation part using F5 Distributed Cloud can be found here (Excessive Data Exposure, Mass Assignment)

API4:2023 Unrestricted Resource Consumption 

Unrestricted Resource Consumption vulnerability occurs when the system’s resources are being unnecessarily consumed, which could eventually lead to degradation of services and performance latency issues. Although the name has changed, the vulnerability is still the same as that of Lack of Resources & Rate Limiting. 

To prevent this vulnerability, rate-limiting, maximum size for input payload/parameters and server-side validations of requests should be enforced. 

Detailed explanation about the vulnerability with a demo showcasing the mitigation part using F5 Distributed Cloud can be found here

API5:2023 Broken Function Level Authorization 

Broken Function Level Authorization occurs when vulnerable API endpoints allow normal users to perform administrative actions or a user from one group is allowed to access a function specific to users of another group. 

To prevent this vulnerability, access control policies and administrative authorization checks based on user’s group/roles should be implemented. 

API6:2023 Unrestricted Access to Sensitive Business Flows 

Unrestricted Access to Sensitive Business Flows is also a new addition to the list of API vulnerabilities. While writing API endpoints, it is extremely critical for developers to have a clear understanding of the business flows getting exposed by it. To avoid exposing any sensitive business flow and limit its excessive usage, which if not considered, might eventually lead to exploitation by the attackers and cause some serious harm to the business. This also includes securing and limiting access to B2B APIs that are consumed directly and often integrated with minimal protection mechanisms. 

By keeping automation to work, now-a-days, attackers can bypass traditional protection mechanisms. APIs inefficiency in detecting automated bot attacks not only causes business loss but also it can adversely impact the services for real users as well. 

To overcome this vulnerability, enterprises need to have a platform to identify whether the request is from a real user or an automated tool by analyzing and tracking patterns of usage. Device fingerprinting, Integrating Captcha solution, blocking Tor requests, are a few methods which can help to minimize the impact of such automated attacks. 

For more details on automated threats, you can visit OWASP Automated Threats to Web Applications 

Note: Although the vulnerability is new but it contains some references of API10:2019 Insufficient Logging & Monitoring 

Detailed explanation about the vulnerability with a demo showcasing the mitigation part using F5 Distributed Cloud can be found here

API7:2023 Server-Side Request Forgery 

After finding a place in the OWASP Top 10 web application vulnerabilities of 2021, SSRF has now been included in the OWASP API Security Top 10 2023 list as well, showing the severity of this vulnerability. 

Server-Side Request Forgery (SSRF) vulnerability occurs when an API fetches an internal server resource without validating the URL from the user. Attackers exploit this vulnerability by manipulating the URL, which in turn helps them retrieve sensitive data from internal servers. 

To overcome this vulnerability, input data validations should be implemented to ensure that the client supplied input data obeys the expected format. Allow lists should be maintained so that only trusted requests/calls will be processed, and HTTP redirections should be disabled. 

Detailed explanation about the vulnerability with a demo showcasing the mitigation part using F5 Distributed Cloud can be found here

API8:2023 Security Misconfiguration 

Security Misconfiguration is a vulnerability that may arise when security best practices are overlooked. Unwanted exposure of debug logs, unnecessary enabled HTTP Verbs, unapplied latest security patches, missing repeatable security hardening process, improper implementation of CORS policy, etc. are a few examples of security misconfiguration. 

To prevent this vulnerability, systems and entire API stack should be maintained up to date without missing any security patches. Continuous security hardening and configuration tracking process should be carried out. Make sure all API communications take place over a secure channel (TLS) and all servers in the HTTP server chain process incoming requests. Cross-Origin Resource Sharing (CORS) policy should be set up properly. Unnecessary HTTP verbs should be disabled. 

Detailed explanation about the vulnerability with a demo showcasing the mitigation part using F5 Distributed Cloud can be found here

API9:2023 Improper Inventory Management 

Improper Inventory Management vulnerability occurs when organizations don’t have much clarity on their own APIs as well as third-party APIs that they use and lack proper documentation. 

Unawareness with regards to current API version, environment, access control policies, data shared with the third-party etc. can lead to serious business repercussions. 

Clear understanding and proper documentation are the key to overcoming this vulnerability. All the details related to API hosts, API environment, Network access, API version, Integrated services, redirections, rate limiting, CORS policy should be documented correctly and maintained up to date. Documenting every minor detail is advisable and authorized access should be given to these documents. Exposed API versions should be secured along with the production version. A risk analysis is recommended whenever newer versions of APIs are available. 

Detailed explanation about the vulnerability with a demo showcasing the mitigation part using F5 Distributed Cloud can be found here

API10:2023 Unsafe Consumption of APIs 

Unsafe Consumption of APIs is again a newly added vulnerability covering a portion of API8:2019 Injection vulnerability. This occurs when developers tend to apply very little or no sanitization to data received from third-party APIs. 

To overcome this, we should make sure that API interactions take place over an encrypted channel. API data evaluation and sanitization should be carried out before using the data further. Precautionary actions should be taken to avoid unnecessary redirections by using Allow lists. 

Detailed explanation about the vulnerability with a demo showcasing the mitigation part using F5 Distributed Cloud can be found here

 

Related OWASP API Security article series

• Broken Authentication 

• Excessive Data Exposure 

• Mass Assignment 

• Lack of Resources & Rate limiting 

• Security Misconfiguration 

• Improper Assets Management 

• Unsafe consumption of APIs 

• Server-Side Request Forgery 

• Unrestricted Access to Sensitive Business Flows 

• OWASP API Security Top 10 - 2019