OWASP API Security Top 10 2023
A foundational element of innovation in today's app-driven world is the API. From banks, retail and transportation to IoT, autonomous vehicles and smart cities, APIs are a critical part of modern mobile, SaaS and web applications and can be found in customer-facing, partner-facing and internal applications. By nature, APIs expose application logic and sensitive data such as Personally Identifiable Information (PII) and because of this have increasingly become a target for attackers. Without secure APIs, rapid innovation would be impossible.
API Security Impact Statistics
0
API Vulnerabilities
91% of APIs tested0
Average CVSS Score
Critical vulnerabilities0
Median Time to Fix
3.1 months0
Average Vulnerabilities
Per APIAPIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues. Object level authorization checks should be considered in every function that accesses a data source using an ID from the user.
Example: Accessing other users' data by manipulating object IDs in API requests.
Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user's identities temporarily or permanently.
- Weak token management
- Insecure password recovery
- Missing or weak multi-factor authentication
This category combines API3:2019 Excessive Data Exposure and API6:2019 - Mass Assignment, focusing on the root cause: the lack of or improper authorization validation at the object property level.
- Excessive data exposure
- Mass assignment vulnerabilities
- Insufficient property validation
Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage. Other resources such as emails/SMS/phone calls or biometrics validation are made available by service providers via API integrations, and paid for per request.
- Missing rate limiting
- Unbounded resource allocation
- Lack of request size validation
Complex access control policies with different hierarchies, groups, and roles, and an unclear separation between administrative and regular functions, tend to lead to authorization flaws.
- Missing role-based access control
- Insufficient function validation
- Privilege escalation vulnerabilities
APIs vulnerable to this risk expose a business flow - such as buying a ticket, or posting a comment - without compensating for how the functionality could harm the business if used excessively in an automated manner.
- Missing business logic validation
- Insufficient anti-automation measures
- Lack of business flow controls
Server-Side Request Forgery (SSRF) flaws can occur when an API is fetching a remote resource without validating the user-supplied URI. This enables an attacker to coerce the application to send a crafted request to an unexpected destination.
- Missing URL validation
- Insufficient network controls
- Internal network exposure
APIs and the systems supporting them typically contain complex configurations, meant to make the APIs more customizable. Software and DevOps engineers can miss these configurations, or don't follow security best practices when it comes to configuration.
- Default configurations
- Missing security headers
- Insecure cloud settings
APIs tend to expose more endpoints than traditional web applications, making proper and updated documentation highly important. A proper inventory of hosts and deployed API versions also are important to mitigate issues such as deprecated API versions and exposed debug endpoints.
- Missing API documentation
- Deprecated API versions
- Exposed debug endpoints
Developers tend to trust data received from third-party APIs more than user input, and so tend to adopt weaker security standards. In order to compromise APIs, attackers go after integrated third-party services instead of trying to compromise the target API directly.
- Missing input validation
- Insecure API integration
- Untrusted data handling
| Rank | Vulnerability | Description | Impact |
|---|---|---|---|
| 1 | Broken Object Level Authorization | APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues. | Critical |
| 2 | Broken Authentication | Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens. | Critical |
| 3 | Broken Object Property Level Authorization New | Lack of or improper authorization validation at the object property level. | Critical |
| 4 | Unrestricted Resource Consumption | Missing or insufficient rate limiting and resource allocation controls. | High |
| 5 | Broken Function Level Authorization | Complex access control policies leading to authorization flaws. | High |
| 6 | Unrestricted Access to Sensitive Business Flows New | APIs exposing business flows without proper controls against automated abuse. | High |
| 7 | Server Side Request Forgery | APIs fetching remote resources without validating user-supplied URIs. | High |
| 8 | Security Misconfiguration | Missing or insecure configurations in API infrastructure. | High |
| 9 | Improper Inventory Management | Lack of proper API documentation and version management. | High |
| 10 | Unsafe Consumption of APIs | Insecure handling of data from third-party APIs. | High |
The OWASP API Security Top 10 2023 is based on a consensus of security experts from around the world. The risks are ranked by exploitability, detectability, and impact. Organizations should use this list to understand the most critical API security risks and take appropriate measures to protect their APIs.
Source: OWASP API Security Project