API Security Project

Top-10 Release Candidate

OWASP Projects’ Showcase
Sep 12, 2019

TM
GLOBAL APPSEC DC
Founders and Sponsors

OWASP GLOBAL APPSEC - DC

 Project Leaders
Erez Yalon Inon Shkedy

- Director of Security Research - Head of Research

@ Checkmarx @ Traceable.ai
- Focusing on Application Security - 7 Years of research and pentesting
experience
- Strong believer in spreading security
awareness - I’ve grown up with APIs

OWASP GLOBAL APPSEC - DC

 ● How APIs-Based apps are different?
Why deserve their own project?
● Roadmap
Today’s ● Call for contributors
Agenda ● API Security Top 10 RC
● Acknowledgements
● Call for contributors

OWASP GLOBAL APPSEC - DC

How API Based Apps are Different?

Client devices are becoming varied and stronger

Logic moves from Backend to Frontend

(together with some vulnerabilities)

OWASP GLOBAL APPSEC - DC

 Traditional vs. Modern

Traditional Get
Application
HTML

API Get
Modern
Application
Raw

OWASP GLOBAL APPSEC - DC

 Traditional vs. Modern

Less abstraction layers

Client and server (and DB) speak the same JSON
language
API Get
Modern
Application
Raw
JSON JSON JSON

OWASP GLOBAL APPSEC - DC

How API Based Apps are Different?
● The server is used more as a proxy for data
● The rendering component is the client, not the server

● Clients consume raw data

● APIs expose the underlying implementation of the app
● The user’s state is usually maintained and monitored by the
client
● More parameters are sent in each HTTP request (object ID’s,
filters)

OWASP GLOBAL APPSEC - DC

How API Based Apps are Different?

● The REST API standard

● Standardized & generic
● Predictable entry points
● One entry point (URL) can be used for multiple purposes

OWASP GLOBAL APPSEC - DC

How API Based Apps are Different?
The good news

Traditional vulnerabilities are less common in API-Based apps:

• SQLi – Increasing use of ORMs
• CSRF – Authorization headers instead of cookies
• Path Manipulations – Cloud-Based storage
• Classic IT Security Issues - SaaS

OWASP GLOBAL APPSEC - DC

What About Dev(Sec)Ops?

APIs change all the It takes just a few clicks

time to spin up new APIs
(hosts). Too easy!

APIs become hard to

track:
• Shadow APIs
• Old Exposed APIs
OWASP GLOBAL APPSEC - DC
Roadmap – Planned Projects

● API Secrity Top 10

● API Security Cheat Sheet
● crAPI (Completely Ridiculous API
- an intentionally vulnerable API project)

OWASP GLOBAL APPSEC - DC

 Roadmap
Top 10 Cheat Sheet crAPI
2019 Q1 Prepare
2019 Q2 Kick-Off
2019 Q3 V1.0 Kick-Off Prepare
2019 Q4 Collaborate Kick-Off
2020 Q1 V1.0 Collaborate
2020 Q2 V1.0

OWASP GLOBAL APPSEC - DC

The creation process of the Top10

● Internal knowledge and experience

● Internal data collection (Bug bounties reports, published
incidents, etc.)
● Call for Data
● Call for comments

OWASP GLOBAL APPSEC - DC

API Security Top 10
● A1: Broken Object Level Authorization
● A2: Broken Authentication
● A3: Excessive Data Exposure
● A4: Lack of Resources & Rate Limiting
● A5: Broken Function Level Authorization
● A6: Mass Assignment
● A7: Security Misconfiguration
● A8: Injection
● A9: Improper Assets Management
● A10: Insufficient Logging & Monitoring

OWASP GLOBAL APPSEC - DC

 Authorization in APIs -
The Challenge
Admins Supervisors
Code
(Almost in every controller) Hugo

A1 - Object Level
Bob
Users
A5 – Function Level
Configuration or Bob
Inon
Code Sub
user
Sub
user
#1 #2

• Sub users
• Users with
Decentralized different roles
Complex
Mechanism Hierarchies

OWASP GLOBAL APPSEC - DC

A1 – BOLA (Broken Object Level Authorization)

From Sam Houston,

Bugcrowd

OWASP GLOBAL APPSEC - DC

 A1 – BOLA (Broken Object Level Authorization)
Why is it so common?

• The attack surface is much wider

• APIs receive more IDs, because clients maintain the user's state

• No security solution that solves the problem

OWASP GLOBAL APPSEC - DC

A1 – BOLA
Why not "IDOR"?
• "IDOR" - Insecure Direct Object Reference is a cool name

• It's not accurate / indicative enough

• The name "IDOR" hints that the object reference (ID) should be
indirect (e.g.: a salted hash map)
• What would happen if you asked your developers to implement “Indirect”
mechanism in every place that receives ID?

OWASP GLOBAL APPSEC - DC

Illustration – you asked your
developers
to implement an “Indirect
Object Reference Mechanism”
to solve
IDORs in the code.

- The problem is not the Object

Reference, but a lack of
authorization -

OWASP GLOBAL APPSEC - DC

 Found by Daley Bee
OWASP GLOBAL APPSEC - DC
• A2 – Broken Authentication
Why is it so common?
• Authentication endpoints are exposed to anyone by design.

• Software/security engineers have misconceptions.

• OAuth isn't authentication
• API keys should not be used for user's authentication

• Multiple authentication flows in modern apps

• IoT / Mobile / Legacy / Deep links with credentials, etc..

OWASP GLOBAL APPSEC - DC

A2 – Broken Authentication
Lack of protection Misimplementation

Assets that need to be protected

- JWT Supports {“alg”:”none”}
ForgotPassword
- Service doesn’t validate the
Login
Extra
Rate Oauth Provider
Protection
API Moble_Login Limiting - Passwords stored without salt
UpdateLocation (A4)
EditPhoto
- Etc…

- Account lockout mechanism

- Captcha
- Credentials Stuffing Protection
OWASP GLOBAL APPSEC - DC
A3 – Excessive Data Exposure

• APIs expose sensitive data of other users by design

• Why it is so common?
• REST Standard & API economy encourage developers to implement APIs in a
generic way
• Use of generic functions as "to_json" from the Model / ORM, without
thinking about who's the consumer

OWASP GLOBAL APPSEC - DC

A3 – Excessive Data Exposure

Super Safe App

Bob’s Profile

GET v1/users/profiles/717

Name: Bob API

Role: Minion
Hobbies: Bananas Filtering sensitive
data on the client side
is always a bad idea

OWASP GLOBAL APPSEC - DC

A3 - Example from "3fun" app

• Found by Alex Lomas, Pen Test Partners

OWASP GLOBAL APPSEC - DC
 • Found by Alex
Lomas, Pen
Test Partners
OWASP GLOBAL APPSEC - DC
A3 - 3Fun Hack

• Found by Alex
Lomas, Pen
Test Partners

OWASP GLOBAL APPSEC - DC

A4 - Lack of Resources & Rate Limiting

• Might lead to DoS, Brute force attacks

• http://socialnetwork.com/api/v1/users?limit=999999999

OWASP GLOBAL APPSEC - DC

A5 – BFLA (Broken Function Level Authorization)

Legit

Admin
API
Regular
API
API
Public Layer
API

Malicious

Regular user

OWASP GLOBAL APPSEC - DC

 A5 – BFLA
Why it is common in APIs?
• Function Level Authorization can be implemented in different ways:
• Code
• Configuration
• API Gateway

• Easier to detect and exploit in APIs – Endpoints are more predictable

Action Get user’s profile (Regular endpoint) Delete user (Admin endpoint)

Traditional GET /app/users_view.aspx?user_id=1337 POST app/admin_panel/users_mgmt.aspx

Apps
action=delete&user_id=1337

OWASP GLOBAL APPSEC - DC

 A6 – Mass Assignment

• Modern frameworks encourage developers to use “Mass Assignment”

functions
POST /api/users/new

{“username”:”Inon”, ”pass”:”123456”}

POST /api/users/new

{“username”:”Inon”, ”pass”:”123456”, ”role”:”admin”}

Might contain sensitive params that the user should not have access to

OWASP GLOBAL APPSEC - DC

A6 – Mass Assignment

• Easier to exploit in APIs

• Instead of guessing object’s properties, just find a GET method that

returns them

OWASP GLOBAL APPSEC - DC

A7 – Security Misconfiguration

• Weak encryption
• Unnecessary exposed HTTP methods
• No CSRF protection
• Detailed errors
• Improper CORS

Bad Things

OWASP GLOBAL APPSEC - DC

A8 – Injection
Why from A1 to A8?
• The main reason that “Injection” is currently #1 (2017), is because of
SQL Injections.

• SQL Injection are not very common in modern APIs, because:

• Use of ORMs
• Increasing use of NoSQL

• NoSQL injection are a thing, but are usually not as common / severe

OWASP GLOBAL APPSEC - DC

 A9 – Improper Assets Management
Actually two different things

Lack of documentation Exposed Risky Undocumented APIs

beta-api.xxx.com

/v2/download_transactions_as_pdf

/v2/transfer_money /v0/legacy_b2b/export_all_users

API Gateway
payments-api.xxx.com
Client
payment-api.xxx.com
mobile-api.xxx.com

OWASP GLOBAL APPSEC - DC

A9 – Improper Assets Management
Why now ?
• APIs change all the time because of CI/CD, developers are focused on
delivering and not documenting

• Cloud + deployment automation (k8s) ==

Way too easy to spin up new APIs and machines
• API hosts that have been forgotten
• Complete environments that have been forgotten
(excuse me mister , but what the heck is “qa-3-old.app.com” ?)

OWASP GLOBAL APPSEC - DC

A10 - Insufficient Logging & Monitoring

Same as 2017 A10

OWASP GLOBAL APPSEC - DC

Call for Discussions

Mailing List
https://groups.google.co
m/a/owasp.org/d/forum/
api-security-project

OWASP GLOBAL APPSEC - DC

Call for
Contributions
GitHub Project
https://github.com/OWA
SP/API-
Security/blob/develop/C
ONTRIBUTING.md

OWASP GLOBAL APPSEC - DC

https://www.owasp.org/index.php/OWASP_API_Security_Project

https://github.com/OWASP/API-Security

QUESTIONS?

OWASP GLOBAL APPSEC - DC

Rate this Session
API Security Project
Top-10 Release Candidate
Erez Yalon
Inon Shkedy

SCAN THE QR CODE TO

COMPLETE THE SURVEY
Thank You!

TM
GLOBAL APPSEC DC
OWASP, Open Web Application Security Project, Global AppSec and AppSec Days are Trademarks of the OWASP Foundation, Inc.