Top 10 2017-A10-Underprotected APIs - Revision history

T.Gigler: 'Top 10-2017-RC1 A10-Underprotected APIs' has been rejected

2017-12-11T23:36:28Z

'Top 10-2017-RC1 A10-Underprotected APIs' has been rejected

T.Gigler: editorial changes (deleted some empty lines)

2017-04-21T23:15:16Z

editorial changes (deleted some empty lines)

T.Gigler: OWASP Top 10-2017 RC1: A10-Underprotected APIs

2017-04-21T23:11:55Z

OWASP Top 10-2017 RC1: A10-Underprotected APIs

T.Gigler: Deleted doubled argument 'year=2017' in SubsectionAdvancedTemplate => final reference

2017-04-20T22:44:26Z

Deleted doubled argument 'year=2017' in SubsectionAdvancedTemplate => final reference

T.Gigler: Create an empty page for the new Top 10 2017-A10-Underprotected APIs (RC1)

2017-04-20T22:15:16Z

Create an empty page for the new Top 10 2017-A10-Underprotected APIs (RC1)

New page

{{Top_10_2013:TopTemplate
|usenext=2013NextLink
|next={{Top_10:LanguageFile|text=whatsNextforDevelopers|year=2017|language=en}}
|useprev=2013PrevLink
|prev=A9-{{Top_10_2010:ByTheNumbers
|9
|year=2017
|language=en}}
|year=2017
|language=en
}}

{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2017|language=en}}
{{Top_10:SummaryTableTemplate|exploitability=2|prevalence=3|detectability=1|impact=2|year=2017|language=en}}
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}}
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>


</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>


</td>
<td colspan=2 {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>


</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>


</td>
<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>


</td>
{{Top_10_2010:SummaryTableEndTemplate|year=2017}}

{{Top_10:SubsectionTableBeginTemplate|year=2017|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=10|year=2017|language=en}}

{{Top_10_2010:SubsectionAdvancedTemplate|year=2017|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=10|year=2017|language=en}}

{{Top_10_2010:SubsectionAdvancedTemplate|year=2017|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=10|year=2017|language=en}}



{{Top_10_2010:SubsectionAdvancedTemplate|year=2017|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=10|year=2017|language=en}}
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate|year=2017}}
*
{{Top_10_2010:SubSubsectionExternalReferencesTemplate|year=2017|language=en}}
*

{{Top_10_2013:BottomAdvancedTemplate
|type={{Top_10_2010:StyleTemplate}}
|usenext=2013NextLink
|next={{Top_10:LanguageFile|text=whatsNextforDevelopers|year=2017|language=en}}
|useprev=2013PrevLink
|prev=A9-{{Top_10_2010:ByTheNumbers
|9
|year=2017
|language=en}}
|year=2017
|language=en
}}

← Older revision		Revision as of 23:36, 11 December 2017
Line 1:		Line 1:
−	~~{{Top_10_2013:TopTemplate~~	+	#REDIRECT [[Top_10-2017_A10-Insufficient_Logging%26Monitoring]]
−	~~\|usenext=2013NextLink~~	+	<!--- 'Top 10-2017-RC1 A10-Underprotected APIs' has been rejected --->
−	~~\|next={{~~Top_10~~:LanguageFile\|text=whatsNextforDevelopers\|year=2017\|language=en}}~~
−	~~\|useprev=2013PrevLink~~
−	~~\|prev=A9~~-~~{{Top_10_2010:ByTheNumbers~~
−	\|9
−	~~\|year=2017~~
−	~~\|language=en}}~~
−	~~\|year=2017~~
−	~~\|language=en~~
−	}}
−
−	~~{{Top_10_2010:SummaryTableHeaderBeginTemplate\|year=2017\|language=en}}~~
−	~~{{Top_10:SummaryTableTemplate\|exploitability=2\|prevalence=2\|detectability=3\|impact=2\|year=2017\|language=en}}~~
−	~~{{Top_10_2010:SummaryTableHeaderEndTemplate\|year=2017}}~~
−	~~<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate\|year=2017}}>~~
−	<!-~~-- Threat Agents: --->Consider anyone with the ability to send requests to your APIs. Client software is easily reversed and communications are easily intercepted, so obscurity is no defense for APIs.~~
−	~~</td>~~
−	~~<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate\|year=2017}}>~~
−	<!--- ~~Attack Vectors --->Attackers can reverse engineer APIs by examining client code, or simply monitoring communications. Some API vulnerabilities can be automatically discovered, others only by experts.~~
−	~~</td>~~
−	~~<td colspan=2 {{Template:~~Top 10 ~~2010:SummaryTableRowStyleTemplate\|year=2017}}>~~
−	~~<!--- Security Weakness~~ --->Modern web applications and APIs are increasingly composed of rich clients (browser, mobile, desktop) that connect to backend APIs (XML, JSON, RPC, GWT, custom). APIs (microservices, services, endpoints) can be vulnerable to the full range of attacks. Unfortunately, dynamic and sometimes even static tools don’t work well on APIs, and they can be difficult to analyze manually, so these vulnerabilities are often undiscovered.
−	~~</td>~~
−	~~<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate\|year=~~2017~~}}>~~
−	<!--~~- Technical Impacts --->The full range of negative outcomes is possible, including data theft, corruption, and destruction; unauthorized access to the entire application; and complete host takeover.~~
−	~~</td>~~
−	~~<td {{Template:Top 10 2010:SummaryTableRowStyleTemplate\|year=2017}}>~~
−	~~<!--- Business Impacts --->Consider the impact of an API attack on the business. Does the API access critical data or functions? Many~~ APIs ~~are mission critical, so also consider the impact of denial of service attacks.~~
−	~~</td>~~
−	~~{{Top_10_2010:SummaryTableEndTemplate\|year=2017}}~~
−
−	{{Top_10:SubsectionTableBeginTemplate\|year=2017\|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate\|type={{Top_10_2010:StyleTemplate}}\|subsection=vulnerableTo\|position=firstLeft\|risk=10\|year=2017\|language=en}}
−	Testing your APIs for vulnerabilities should be similar to testing the rest of your application for vulnerabilities. All the different types of injection, authentication, access control, encryption, configuration, and other issues can exist in APIs just as in a traditional application.
−
−	However, because APIs are designed for use by programs (not humans) they frequently lack a UI and also use complex protocols and complex data structures. These factors can make security testing difficult. The use of widely-used formats can help, such as Swagger (OpenAPI), REST, JSON, and XML. Some frameworks like GWT and some RPC implementations use custom formats. Some applications and APIs create their own protocol and data formats, like WebSockets. The breadth and complexity of APIs make it difficult to automate effective security testing, possibly leading to a false sense of security.
−
−	~~Ultimately, knowing if your APIs are secure means carefully choosing a strategy to test all defenses that matter.~~
−
−	~~{{Top_10_2010:SubsectionAdvancedTemplate\|type={{Top_10_2010:StyleTemplate}}\|subsection=howPrevent\|position=right\|risk=10\|year=2017\|language=en}}~~
−	~~The key to protecting APIs is to ensure that you fully understand the threat model and what defenses you have:~~
−	~~# Ensure that you have secured communications between the client and your APIs.~~
−	~~# Ensure that you have a strong authentication scheme for your APIs, and that all credentials, keys, and tokens have~~ been ~~secured.~~
−	~~# Ensure that whatever data format your requests use, that the parser configuration is hardened against attack.~~
−	~~# Implement an access control scheme that protects APIs from being improperly invoked, including unauthorized function and data references.~~
−	~~# Protect against injection of all forms, as these attacks are just as viable through APIs as they are for normal apps.~~
−	~~Be sure your security analysis and testing covers all your APIs and your tools can discover and analyze them all effectively.~~
−
−	~~{{Top_10_2010:SubsectionAdvancedTemplate\|type={{Top_10_2010:StyleTemplate}}\|subsection=example\|position=left\|risk=10\|year=2017\|language=en}}~~
−	<u>'''Scenario #1:'''</u> Imagine a mobile banking app that connects to an XML API at the bank for account information and performing transactions. The attacker reverse engineers the app and discovers that the user account number is passed as part of the authentication request to the server along with the username and password. The attacker sends legitimate credentials, but another user’s account number, gaining full access to the other user’s account.
−
−	<u>'''Scenario #2'''</u> Imagine a public API offered by an Internet startup for automatically sending text messages. The API accepts JSON messages that contain a “transactionid” field. The API parses out this “transactionid” value as a string and concatenates it into a SQL query, without escaping or parameterizing it. As you can see the API is just as susceptible to SQL injection as any other type of application.
−
−	~~In either of these cases, the vendor may not provide a web UI to use these services, making security testing more difficult.~~
−	~~<!--- {{Top_10_2010:ExampleBeginTemplate\|year=2017}}~~
−	~~{{Top_10_2010:ExampleEndTemplate}} --->~~
−
−	~~{{Top_10_2010:SubsectionAdvancedTemplate\|type={{Top_10_2010:StyleTemplate}}\|subsection=references\|position=right\|risk=10\|year=2017\|language=en}}~~
−	~~{{Top_10_2010:SubSubsectionOWASPReferencesTemplate\|year=2017}}~~
−	* <u>[[REST_Security_Cheat_Sheet\|OWASP REST Security Cheat Sheet]]</u>
−	* <u>[[Web_Service_Security_Cheat_Sheet\|OWASP Web Service Security Cheat Sheet]]</u>
−
−	~~{{Top_10_2010:SubSubsectionExternalReferencesTemplate\|year=2017\|language=en}}~~
−	* <u>[https://code.tutsplus.com/articles/the-increasing-importance-of-apis-in-web-development--net-22368 Increasing Importance of APIs in Web Development]</u>
−	* <u>[https://nordicapis.com/tracking-the-growth-of-the-api-economy/ Tracking the Growth of the API Economy]</u>
−	* <u>[https://techcrunch.com/2015/09/27/the-future-of-coding-is-here-and-threatens-to-wipe-out-everything-in-its-path/ The API Centric Future]</u>
−	* <u>[https://www.cronofy.com/blog/the-growth-of-the-api/ The Growth of the API]</u>
−	* <u>[http://www.darkreading.com/application-security/what-do-you-mean-my-security-tools-dont-work-on-apis!!/a/d-id/1321050 What Do You Mean My Security Tools Don’t Work on APIs?!!]</u><!--- http --->
−	* <u>[https://www.soapui.org/testing-dojo/world-of-api-~~testing/state~~-of-~~api-security.html State of API Security]</u~~>
−
−	~~{{Top_10_2013:BottomAdvancedTemplate~~
−	~~\|type={{Top_10_2010:StyleTemplate}}~~
−	~~\|usenext=2013NextLink~~
−	~~\|next={{Top_10:LanguageFile\|text=whatsNextforDevelopers\|year=2017\|language=en}}~~
−	~~\|useprev=2013PrevLink~~
−	~~\|prev=A9-{{Top_10_2010:ByTheNumbers~~
−	\|9
−	~~\|year=2017~~
−	~~\|language=en}}~~
−	~~\|year=2017~~
−	~~\|language=en~~
−	}}

@@ Line 16: / Line 16: @@
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Threat Agents: --->Consider anyone with the ability to send requests to your APIs. Client software is easily reversed and communications are easily intercepted, so obscurity is no defense for APIs.
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Attack Vectors --->Attackers can reverse engineer APIs by examining client code, or simply monitoring communications. Some API vulnerabilities can be automatically discovered, others only by experts.
 </td>
       <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Security Weakness --->Modern web applications and APIs are increasingly composed of rich clients (browser, mobile, desktop) that connect to backend APIs (XML, JSON, RPC, GWT, custom). APIs (microservices, services, endpoints) can be vulnerable to the full range of attacks. Unfortunately, dynamic and sometimes even static tools don’t work well on APIs, and they can be difficult to analyze manually, so these vulnerabilities are often undiscovered.
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Technical Impacts --->The full range of negative outcomes is possible, including data theft, corruption, and destruction; unauthorized access to the entire application; and complete host takeover.
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
 <!--- Business Impacts  --->Consider the impact of an API attack on the business. Does the API access critical data or functions? Many APIs are mission critical, so also consider the impact of denial of service attacks.
 </td>
 {{Top_10_2010:SummaryTableEndTemplate|year=2017}}

@@ Line 12: / Line 12: @@
 {{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2017|language=en}}
-  {{Top_10:SummaryTableTemplate|exploitability=2|prevalence=3|detectability=1|impact=2|year=2017|language=en}}
+  {{Top_10:SummaryTableTemplate|exploitability=2|prevalence=2|detectability=3|impact=2|year=2017|language=en}}
 {{Top_10_2010:SummaryTableHeaderEndTemplate|year=2017}}
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
-<!--- Threat Agents: --->
+<!--- Threat Agents: --->Consider anyone with the ability to send requests to your APIs. Client software is easily reversed and communications are easily intercepted, so obscurity is no defense for APIs.
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
-<!--- Attack Vectors --->
+<!--- Attack Vectors --->Attackers can reverse engineer APIs by examining client code, or simply monitoring communications. Some API vulnerabilities can be automatically discovered, others only by experts.
 </td>
       <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
-<!--- Security Weakness --->
+<!--- Security Weakness --->Modern web applications and APIs are increasingly composed of rich clients (browser, mobile, desktop) that connect to backend APIs (XML, JSON, RPC, GWT, custom). APIs (microservices, services, endpoints) can be vulnerable to the full range of attacks. Unfortunately, dynamic and sometimes even static tools don’t work well on APIs, and they can be difficult to analyze manually, so these vulnerabilities are often undiscovered.
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
-<!--- Technical Impacts --->
+<!--- Technical Impacts --->The full range of negative outcomes is possible, including data theft, corruption, and destruction; unauthorized access to the entire application; and complete host takeover.
 </td>
       <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2017}}>
-<!--- Business Impacts  --->
+<!--- Business Impacts  --->Consider the impact of an API attack on the business. Does the API access critical data or functions? Many APIs are mission critical, so also consider the impact of denial of service attacks.
 </td>
@@ Line 37: / Line 38: @@
 {{Top_10:SubsectionTableBeginTemplate|year=2017|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=10|year=2017|language=en}}
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=10|year=2017|language=en}}
+The key to protecting APIs is to ensure that you fully understand the threat model and what defenses you have:
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=10|year=2017|language=en}}
 <!--- {{Top_10_2010:ExampleBeginTemplate|year=2017}}
 {{Top_10_2010:ExampleEndTemplate}} --->
@@ Line 50: / Line 64: @@
 {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=references|position=right|risk=10|year=2017|language=en}}
 {{Top_10_2010:SubSubsectionOWASPReferencesTemplate|year=2017}}
+* <u>[[REST_Security_Cheat_Sheet|OWASP REST Security Cheat Sheet]]</u>
 {{Top_10_2010:SubSubsectionExternalReferencesTemplate|year=2017|language=en}}
+* <u>[https://code.tutsplus.com/articles/the-increasing-importance-of-apis-in-web-development--net-22368 Increasing Importance of APIs in Web Development]</u>
 {{Top_10_2013:BottomAdvancedTemplate