Data Leaks in Public APIs

During a website's cybersecurity assessment, it is critical to understand the public footprint. One area for low hanging fruit is inspecting network traffic for public APIs.

With a little investigating we can pretty quickly identify if data can be leaked from a website. A common problem is unprotected public APIs with unsafe parameters. Think about the parameter num_results=5. What if we try num_results=1000 or even further, what about num_results=1000000?

Interesting right?

In a lot of cases this returns a much higher limit than expected, if not the entire amount requested.

Notwithstanding the hazard of potential data leaks, there are other serious threats from unvalidated user input into public APIs. Although automated fuzzing and source code exploration are beyond the scope of this article, it is important to mention that they can be quite lucrative when auditing a company's security posture.

The Server's Perspective

From the server's standpoint, if the API returns too many results the server can easily detect the anomalous requests based on the transfer size being larger than normal. Similarly the request alone is unusual because it is not a standard input. Now on the flip side, most endpoints are tracking the number of requests being made and in this case the number is not abnormal. Therefore the amount of stealth is dependent on the depth and breadth of the company's tracking. It is possible an Endpoint Detection and Response (EDR) or Intrusion Prevention System (IPS) might be triggered or possibly block the requests as a threat, though not likely at first.

Securing API Endpoints

The amount of effort utilized in securing endpoint depends on the business threat model and risks. How important is the data provided from the API? Are there other APIs that have similar problems? Is there location based compliance? Is the website aiming to block rogue bots and scrapers?

Once the need is determined, the methodology is relatively straightforward.

• Validate user input
• Monitor requests

At the root of the problem is that APIs need to validate input – ensuring that parameters adhere to strict input requirements. This can be simple or complex, but as with all things in security, simple is generally better. Slim solutions can be easily checked and managed.

Next up is traffic monitoring and anomaly detection. This can be done by adding monitoring for larger than normal requests, checking for patterns in the timing of requests based on unique fingerprints (IP addresses, user-agents, etc.), and of course AI detection through advanced providers.