Security Vulnerability Guide

This section lists important vulnerabilities applicable to modern API driven applications.

OWASP API Top 10

Rank	Vulnerability	CWE
A1	Broken Object Level Authorization	639
A2	Broken Authentication	425, 287
A3	Excessive Data Exposure	213
A4	Lack of Resources and Rate Limits	770
A5	Broken Function Level Authorization	1220
A6	Mass Assignment	915
A7	Security Misconfiguration	1349
A8	Injection	89, 77
A9	Improper Asset Management	1059
A10	Insufficient Logging & Monitoring	778

OWASP Web Top 10

Rank	Vulnerability	CWE
A10	Server Side Request Forgery	918

Miscellaneous

This section lists issues related to API security and resilience, but which cannot be purely categorized as security vulnerabilities.

Issue	CWE
API Schema Non Conformance	1215, 393
Unexpected 5XX Server Errors	600
Undocumented Response Codes	394
Inadequate Response Headers	838
Incorrect Response Content Types	838
Incorrect Response Body	838

Baseline

Baseline Security Controls are a minimum set of foundational controls that APIs should implement. These are based on security best practices.

This section lists vulnerabilities arising due to the violation of these security controls. A number of these issues are applicable to OWASP API A7.

Issue	CWE / Reference
In Page Banner Information Leak	Testing for Error Codes
Information Disclosure - Debug Error Messages	CWE-200
Information Disclosure - Sensitive Information in URL	CWE-200
Information Disclosure - Sensitive Information in HTTP Referrer Header	CWE-200
Application Error Disclosure	CWE-200
X-Powered-By Information Leak	CWE-200
Information Leak Via 'Server' HTTP Response Header	CWE-200
Private IP Disclosure In Response	CWE-200
PII Disclosure In Response	CWE-359
Hash Disclosure In Response	CWE-200
Cross-Domain (CORS) Misconfiguration (Passive)	CWE-264
Sub Optimal Cache Control Directives	CWE-525
Content Retrieved from Cache	CWE-525
Missing Strict-Transport-Security Header	Strict Transport Security Cheat Sheet
Missing Content-Type Header	CWE-345
Missing X-Content-Type-Options Header	CWE-693
Cookie Set Without HttpOnly Flag	CWE-1004
Cookie Without Secure Flag	CWE-614
Cookie Poisoning Via Query/Body Parameters	CWE-20
Session ID in URL Via Rewrite	CWE-200
Suboptimal Anti-clickjacking Headers	CWE-1021
Open/Unrestricted URL Redirect Via URL Query Parameter	CWE-601
Weak Authentication Method	CWE-326
Java Serialization Detected	CWE-502