API Abuse
API abuse arises when an attacker uses a programming interface in a way the application did not anticipate or did not restrict enough. An API is not merely a technical add-on to the application. It is often the main entrance to the data, the users, the orders, the payments and the administration.
Term
description · examples · notesAPI abuse arises when an attacker uses a programming interface in a way the application did not anticipate or did not restrict enough. An API is not merely a technical add-on to the application. It is often the main entrance to the data, the users, the orders, the payments and the administration.
Description
The most common problem is not a spectacular exploit but a poor check of rights. If a user can change a number in the URL and see somebody else's invoice, if they can call an endpoint the frontend never displays, or if there is no limit on the number of requests, the API becomes open ground for systematic abuse.
API attacks are awkward because they look like normal traffic. There need be no malware, no link, no file. There are only requests, tokens, parameters and a pace that suddenly resembles a script methodically checking what it can take rather than a person at work.
Examples
- The attacker changes a numeric ID in an API request and reaches other users' data.
- A data export endpoint has no authorization check, so an ordinary account can pull the entire user list.
- An automated script gets around a weakly configured rate limit and harvests data from a public API in bulk.
Notes
- If an API endpoint exists, it should be protected as public attack surface, even when the frontend does not display it.
- Authentication says who the user is. Authorization says what that user may do. With APIs it is most often the second step where things fail.
Mentioned in the news
Techniques
carried out with 5Techniques used to carry it out. Select one to open its page.
Defenses
countered by 4How it is defended against. Select one to open its page.