API Security · Lesson 11

Security: OWASP API Top 10 Deep Dive

While standard web application security focuses on injection and cross-site scripting, API security has different weak spots. The OWASP API Security Top 10 outlines risks unique to resource-oriented interfaces. We will deep-dive into three of the most common and destructive modern API vulnerabilities: Server-Side Request Forgery (SSRF), Mass Assignment, and Unrestricted Access to Sensitive Business Flows.

1. Server-Side Request Forgery (SSRF)

SSRF (OWASP API7:2023) occurs when an API endpoint accepts a user-supplied URL and makes a request to it from the backend server. Since the server operates inside the company's internal private network, an attacker can supply local IP addresses (e.g. http://127.0.0.1 or http://169.254.169.254) to access internal metadata services, databases, or administration panels that are closed to the public internet.

SSRF Mitigation Checklist

1. IP Address Validation. Resolve the hostname to an IP address before establishing the socket. Reject the request if the resolved IP points to private ranges: 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254.
2. DNS Rebinding Protection. Attackers can bypass initial checks by returning a public IP during resolution, then immediately swapping it to a private IP when the client makes the connection. Fix: pin the resolved IP address and connect directly to it, disabling automatic host header re-lookup.
3. Isolate Fetchers. Run the URL-fetching service in an isolated network sandbox or VPC lane with zero access to internal databases.

2. Mass Assignment

Mass Assignment (OWASP API3:2023 - Broken Object Property Level Authorization) occurs when an API framework automatically binds user-supplied JSON properties directly to internal database objects or ORM models. If the database object includes columns like is_admin or role, an attacker can insert these keys into their API request payloads to escalate their privileges.

// ❌ VULNERABLE: Direct model binding
func UpdateProfile(w http.ResponseWriter, r *http.Request) {
    var user User
    json.NewDecoder(r.Body).Decode(&user) // Decodes whatever keys the client sent!
    db.Save(&user)
}

// Payload sent by attacker to elevate status:
{
  "display_name": "Attacker",
  "is_admin": true
}

Mass Assignment Defenses

• Data Transfer Objects (DTOs). Never bind request bodies directly to database models. Instead, parse inputs into dedicated request schemas (DTOs) that contain only the properties developers explicitly want to allow users to modify (e.g. UpdateProfileRequest containing only display_name and avatar_url).
• Schema Schemas & Validation. Use strict JSON schemas to validate properties and throw a 400 Bad Request error if additional, unrecognized keys are submitted.

3. Unrestricted Access to Sensitive Business Flows

Sensitive Business Flow Abuse (OWASP API6:2023) occurs when an API exposes actions that have high business impact or cost (e.g., ticket booking, promo code redemption, SMS OTP verification, account creation) and fails to limit how quickly or frequently they can be executed by automated bots.

Unlike standard rate limiting which blocks sudden volumetric DDOS attacks, abusers of sensitive flows often crawl slowly (low and slow) using rotated proxies to bypass IP-based limiters, draining company funds (e.g. paying for SMS gateway fees) or scraping inventory.

Under the hood: SSRF connection hijacking

This diagram shows how an attacker utilizes a vulnerable webhook-validator API to fetch database credentials from an internal AWS metadata server.

By the numbers: SMS gateway abuse budget math

Let's calculate the financial impact of unrestricted business flow exploitation and compute velocity limit thresholds.

Governing Equations

• Abuse Cost Accumulation: If an attacker exploits an unprotected OTP/SMS endpoint at rate $R$ (requests/min), and each SMS carrier delivery costs $C_{sms}$ dollars: $$Cost_{min} = R \times C_{sms}$$
• IP-Rotated attack threshold: If rate limiters only track IP addresses, and attackers rotate through proxy pool $P$ at $N$ IPs per minute: $$Limit_{IP} \times P = \text{Bypassed Rate}$$
• SMS Cost Burn Curve: $$Total_{cost} = Rate_{bypass} \times C_{sms} \times T_{duration}$$

Scenario Parameters

• Cost per SMS (India/Global mixed carriers): $0.04
• Attacker Proxy Pool ($P$): 20,000 distinct residential IP addresses
• IP Rate Limit: 5 requests per minute per IP (standard rate limit)
• Attack Duration ($T$): 8 hours (480 minutes)

Worked Calculations: Financial Loss under IP Limiting

1. Compute the bypassed request rate: Since the attacker can make 5 calls per IP before triggering a block, they spread requests across 20,000 IPs: $$Rate_{bypass} = 20,000 \text{ IPs} \times 5 \text{ reqs/min} = 100,000 \text{ requests/minute}$$ $$Event_{rate} = 1,666.6 \text{ requests/second}$$
2. Compute the cost rate per minute: $$Cost_{minute} = 100,000 \text{ requests/min} \times \$0.04 = \$4,000 / \text{minute}$$
3. Compute total 8-hour exposure cost: $$Total_{cost} = \$4,000/\text{min} \times 480 \text{ minutes} = \mathbf{\$1,920,000}$$ This is a massive financial blow for a single night!

How to debug & inspect it

To inspect and identify OWASP API vulnerabilities, capture and analyze request payloads and DNS resolutions using common network utilities.

Use the guide below to trace and repair vulnerabilities in your API schemas and networks:

function safe_fetch_url(user_url_str) {
    // 1. Parse URL structure
    parsed_url = parse_url(user_url_str)
    if parsed_url.scheme not in ["http", "https"]:
        raise ValueError("Invalid scheme")
    
    // 2. Resolve hostname to IP address
    resolved_ips = dns_resolve(parsed_url.hostname)
    if not resolved_ips:
        raise ValueError("Could not resolve host")
    
    target_ip = resolved_ips[0]
    
    // 3. Verify IP is not in private/reserved ranges (RFC 1918)
    if is_private_ip(target_ip) or is_link_local_ip(target_ip) or is_loopback_ip(target_ip):
        raise ValueError("Access to private/local network ranges is forbidden")
        
    // 4. Perform the HTTP request directly to target_ip
    // Set 'Host' header to parsed_url.hostname so the server receives correct routing headers
    http_headers = { "Host": parsed_url.hostname }
    response = execute_http_get(connection_target=target_ip, port=parsed_url.port, headers=http_headers)
    
    return response
}

Sources & further reading

• OWASP API Security Top 10 (2023 Edition) — the official reference for API vulnerabilities
• Mitre CVE Repository — Mass Assignment & SSRF Cases — real-world examples of CVE exploits targeting corporate APIs
• Cloudflare Learning — DNS Rebinding Protection — technical mechanisms to prevent rebinding exploits