Skip to content

Commit c21153c

Browse files
PauloASilvaPauloASilva
committed
feat(2019): OWASP API Security Top 10 - 2019 draft
1 parent 0530202 commit c21153c

27 files changed

+348
-0
lines changed

‎2019/en/0x00-header.md

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
![OWASP LOGO](images/owasp-logo.png)
2+
3+
## OWASP API Security Top 10 2019
4+
5+
The Ten Most Critical API Security Risks
6+
7+
May 29th, 2019
8+
9+
![WASP Logo URL TBA](images/front-wasp.png)
10+
11+
| | | |
12+
| - | - | - |
13+
| https://owasp.org | This work is licensed under a [Creative Commons Attribution-ShareAlike 4.0 International License][1] | ![Creative Commons License Logo](images/front-cc.png) |
14+
15+
[1]: http://creativecommons.org/licenses/by-sa/4.0/
16+
17+

‎2019/en/0x00-notice.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
Notice
2+
======
3+
4+
This is the text version of OWASP API Security Top 10, used as source for the
5+
official version distributed as a Portable Document Format (PDF).
6+
7+
Contributions to the project such as comments, corrections or translations
8+
should be done here. For details on [How To Contribute][1], please refer to
9+
[CONTRIBUTING.md][1].
10+
11+
* Erez Yallon
12+
* Inon Shkedy
13+
14+
[1]: ../../CONTRIBUTING.md

‎2019/en/0x00-toc.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
Table of Contents
2+
=================
3+
4+
* [Table of Contents](0x00-toc.md)
5+
* [About OWASP](0x01-about-owasp.md)
6+
* [Foreword](0x02-foreward.md)
7+
* [Introduction](0x03-introduction.md)
8+
* [Release Notes](0x04-release-notes.md)
9+
* [API Security Risks](0x10-api-security-risks.md)
10+
* [OWASP Top 10 API Security Risks – 2019](0x11-t10.md)
11+
* [A1:2019 Object Level Access Control](0xa1-object-level-access-control.md)
12+
* [A2:2019 Broken Authentication](0xa2-broken-authentication.md)
13+
* [A3:2019 Improper Data Filtering](0xa3-improper-data-filtering.md)
14+
* [A4:2019 Improper Resources Limiting or Throttling](0xa4-improper-resources-limiting-throttling.md)
15+
* [A5:2019 Sensitive Data Exposure](0xa5-sensitive-data-exposure.md)
16+
* [A6:2019 Missing Function/Resource Level Access Control](0xa6-missing-function-resource-level-access-control.md)
17+
* [A7:2019 Security Misconfiguration](0xa7-security-misconfiguration.md)
18+
* [A8:2019 Injection](0xa8-injection.md)
19+
* [A9:2019 Improper Assets Management](0xa9-improper-assets-management.md)
20+
* [A10:2019 Insufficient Logging & Monitoring](0xaa-insufficient-logging-monitoring.md)
21+
* [What's Next For Developers](0xb0-next-devs.md)
22+
* [What's Next For DevSecOps](0xb1-next-devsecops.md)
23+
* [Methodology and Data](0xd0-about-data.md)
24+
* [Acknowledgments](0xd1-acknowledgments.md)

‎2019/en/0x01-about-owasp.md

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
About OWASP
2+
===========
3+
4+
The Open Web Application Security Project (OWASP) is an open community dedicated
5+
to enabling organizations to develop, purchase, and maintain applications and
6+
APIs that can be trusted.
7+
8+
At OWASP, you'll find free and open:
9+
10+
* Application security tools and standards.
11+
* Complete books on application security testing, secure code development, and
12+
secure code review.
13+
* Presentations and [videos][1].
14+
* [Cheat sheets][2] on many common topics.
15+
* Standard security controls and libraries.
16+
* [Local chapters worldwide][3].
17+
* Cutting edge research.
18+
* Extensive [conferences worldwide][4].
19+
* [Mailing lists][5].
20+
21+
Learn more at: [https://www.owasp.org][6].
22+
23+
All OWASP tools, documents, videos, presentations, and chapters are free and
24+
open to anyone interested in improving application security.
25+
26+
We advocate approaching application security as a people, process, and
27+
technology problem, because the most effective approaches to application
28+
security require improvements in these areas.
29+
30+
OWASP is a new kind of organization. Our freedom from commercial pressures
31+
allows us to provide unbiased, practical, and cost-effective information about
32+
application security.
33+
34+
OWASP is not affiliated with any technology company, although we support the
35+
informed use of commercial security technology. OWASP produces many types of
36+
materials in a collaborative, transparent, and open way.
37+
38+
The OWASP Foundation is the non-profit entity that ensures the project's
39+
long-term success. Almost everyone associated with OWASP is a volunteer,
40+
including the OWASP board, chapter leaders, project leaders, and project
41+
members. We support innovative security research with grants and infrastructure.
42+
43+
Come join us!
44+
45+
## Copyright and License
46+
47+
![license](images/license.png)
48+
49+
Copyright © 2003-2017 The OWASP Foundation. This document is released under the
50+
[Creative Commons Attribution Share-Alike 4.0 license][7]. For any reuse or
51+
distribution, you must make it clear to others the license terms of this work.
52+
53+
[1]: https://www.youtube.com/user/OWASPGLOBAL
54+
[2]: https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series
55+
[3]: https://www.owasp.org/index.php/OWASP_Chapter
56+
[4]: https://www.owasp.org/index.php/Category:OWASP_AppSec_Conference
57+
[5]: https://lists.owasp.org/mailman/listinfo
58+
[6]: https://www.owasp.org
59+
[7]: http://creativecommons.org/licenses/by-sa/4.0/

‎2019/en/0x02-foreword.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Foreword
2+
========

‎2019/en/0x03-introduction.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Introduction
2+
============

‎2019/en/0x04-release-notes.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Release Notes
2+
=============

‎2019/en/0x10-api-security-risks.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
API Security Risks
2+
==================

‎2019/en/0x11-t10.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
OWASP Top 10 API Security Risks – 2019
2+
======================================
3+
4+
| Risk | Description |
5+
| ---- | ----------- |
6+
| A1:2019 - Object Level Access Control | APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface. Insecure Direct Object References (IDOR) is the most widespread Object Level Access Control issue. Object level authorization checks should be taken in mind in every function that accesses a data source using an input from the user. |
7+
| A2:2019 - Broken Authentication | Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user's identities temporarily or permanently. Compromising system's ability to identify the client/user, compromises API overall security. |
8+
| A3:2019 - Improper Data Filtering | Looking forward to generic implementations developers tend to expose all object properties without considering their individual sensitivity, relying on clients to perform the data filtering before showing it to the user. Without controlling client's state, servers receive more and more filters which can be abused to gain access to sensitive data. |
9+
| A4:2019 - Improper Resources Limiting or Throttling | Quite often APIs do not impose any restrictions on the size or number of resources that can be requested by the client/user. Not only this can impact the API server performance, leading to Denial of Service (DoS), but also leaves the door open to authentication flaws such as brute force. |
10+
| A5:2019 - Sensitive Data Exposure | Many APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser. |
11+
| A6:2019 - Missing Function/Resource Level Access Control | Complex access control policies with different hierarchies, groups and roles and a not so clear separation between administrative and regular functions tend to lead to authorization flaws. Exploiting these issues, attackers gain access to other users resources and/or administrative functions. |
12+
| A7:2019 - Security Misconfiguration | Security misconfiguration is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, unnecessary HTTP methods, permissive Cross-Origin resource sharing (CORS) and verbose error messages containing sensitive information. |
13+
| A8:2019 - Injection | Injection flaws, such as SQL, NoSQL, Command Injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. |
14+
| A9:2019 - Improper Assets Management | APIs tend to expose more endpoints than traditional web applications, what makes proper and updated documentation highly important. Proper hosts and deployed API versions inventory also play an important role to mitigate issues such as deprecated API versions and exposed debug endpoints. |
15+
| A10:2019 - Insufficient Logging & Monitoring | Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring. |

‎2019/en/0xa1-object-level-access-control.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
A1:2019 Object Level Access Control
2+
===================================
3+
4+
| Threat agents/Attack vectors | Security Weakness | Impacts |
5+
| -- | -- | -- |
6+
| Access Lvl : Exploitability ? | Prevalence ? : Detectability ? | Technical ? : Business |
7+
| | | |
8+
9+
## Is the API Vulnerable?
10+
11+
## How To Prevent
12+
13+
## Example Attack Scenarios
14+
15+
## References
16+
17+
### OWASP
18+
19+
### External

0 commit comments

Comments
 (0)