Skip to content

Commit 3717bdc

Browse files
PauloASilvaPauloASilva
committed
chore(2023): Add missing sections
1 parent 96d08ca commit 3717bdc

18 files changed

+524
-0
lines changed

‎2023/en/src/0x00-header.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
![OWASP LOGO](images/owasp-logo.png)
2+
3+
## OWASP API Security Top 10 2019
4+
5+
The Ten Most Critical API Security Risks
6+
7+
May 29th, 2019
8+
9+
![WASP Logo URL TBA](images/front-wasp.png)
10+
11+
| | | |
12+
| - | - | - |
13+
| https://owasp.org | This work is licensed under a [Creative Commons Attribution-ShareAlike 4.0 International License][1] | ![Creative Commons License Logo](images/front-cc.png) |
14+
15+
[1]: http://creativecommons.org/licenses/by-sa/4.0/
16+
17+

‎2023/en/src/0x00-notice.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
Notice
2+
======
3+
4+
This is the text version of OWASP API Security Top 10, used as source for any
5+
official versions of this document such the web site.
6+
7+
Contributions to the project such as comments, corrections, or translations
8+
should be done here. For details on [How To Contribute][1], please refer to
9+
[CONTRIBUTING.md][1].
10+
11+
* Erez Yallon
12+
* Inon Shkedy
13+
* Paulo Silva
14+
15+
[1]: ../../CONTRIBUTING.md

‎2023/en/src/0x00-toc.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
Table of Contents
2+
=================
3+
4+
* [Table of Contents](0x00-toc.md)
5+
* [About OWASP](0x01-about-owasp.md)
6+
* [Foreword](0x02-foreward.md)
7+
* [Introduction](0x03-introduction.md)
8+
* [Release Notes](0x04-release-notes.md)
9+
* [API Security Risks](0x10-api-security-risks.md)
10+
* [OWASP Top 10 API Security Risks – 2023](0x11-t10.md)
11+
* [API1:2023 Broken Object Level Authorization](0xa1-broken-object-level-authorization.md)
12+
* [API2:2023 Broken Authentication](0xa2-broken-authentication.md)
13+
* [API3:2023 Broken Object Property Level Authorization](0xa3-broken-object-property-level-authorization.md)
14+
* [API4:2023 Unrestricted Resource Consumption](0xa4-unrestricted-resource-consumption.md)
15+
* [API5:2023 Broken Function Level Authorization](0xa5-broken-function-level-authorization.md)
16+
* [API6:2023 Server Side Request Forgery](0xa6-server-side-request-forgery.md)
17+
* [API7:2023 Security Misconfiguration](0xa7-security-misconfiguration.md)
18+
* [API8:2023 Lack of Protection from Automated Threats](0xa8-lack-of-protection-from-automated-threats.md)
19+
* [API9:2023 Improper Inventory Management](0xa9-improper-inventory-management.md)
20+
* [API10:2023 Unsafe Consumption of APIs](0xaa-unsafe-consumption-of-apis.md)
21+
* [What's Next For Developers](0xb0-next-devs.md)
22+
* [What's Next For DevSecOps](0xb1-next-devsecops.md)
23+
* [Methodology and Data](0xd0-about-data.md)
24+
* [Acknowledgments](0xd1-acknowledgments.md)

‎2023/en/src/0x01-about-owasp.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
About OWASP
2+
===========
3+
4+
The Open Worldwide Application Security Project (OWASP) is an open community
5+
dedicated to enabling organizations to develop, purchase, and maintain
6+
applications and APIs that can be trusted.
7+
8+
At OWASP, you'll find free and open:
9+
10+
* Application security tools and standards.
11+
* Complete books on application security testing, secure code development, and
12+
secure code review.
13+
* Presentations and [videos][1].
14+
* [Cheat sheets][2] on many common topics.
15+
* Standard security controls and libraries.
16+
* [Local chapters worldwide][3].
17+
* Cutting edge research.
18+
* Extensive [conferences worldwide][4].
19+
* [Mailing lists][5] ([archive][6]).
20+
21+
Learn more at: [https://www.owasp.org][7].
22+
23+
All OWASP tools, documents, videos, presentations, and chapters are free and
24+
open to anyone interested in improving application security.
25+
26+
We advocate approaching application security as a people, process, and
27+
technology problem, because the most effective approaches to application
28+
security require improvements in these areas.
29+
30+
OWASP is a new kind of organization. Our freedom from commercial pressures
31+
allows us to provide unbiased, practical, and cost-effective information about
32+
application security.
33+
34+
OWASP is not affiliated with any technology company, although we support the
35+
informed use of commercial security technology. OWASP produces many types of
36+
materials in a collaborative, transparent, and open way.
37+
38+
The OWASP Foundation is the non-profit entity that ensures the project's
39+
long-term success. Almost everyone associated with OWASP is a volunteer,
40+
including the OWASP board, chapter leaders, project leaders, and project
41+
members. We support innovative security research with grants and infrastructure.
42+
43+
Come join us!
44+
45+
## Copyright and License
46+
47+
![license](images/license.png)
48+
49+
Copyright © 2003-2023 The OWASP Foundation. This document is released under the
50+
[Creative Commons Attribution Share-Alike 4.0 license][8]. For any reuse or
51+
distribution, you must make it clear to others the license terms of this work.
52+
53+
[1]: https://www.youtube.com/user/OWASPGLOBAL
54+
[2]: https://cheatsheetseries.owasp.org/
55+
[3]: https://owasp.org/chapters/
56+
[4]: https://owasp.org/events/
57+
[5]: https://groups.google.com/a/owasp.org/forum/#!overview
58+
[6]: https://lists.owasp.org/mailman/listinfo
59+
[7]: https://www.owasp.org
60+
[8]: http://creativecommons.org/licenses/by-sa/4.0/

‎2023/en/src/0x02-foreword.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
Foreword
2+
========
3+
4+
A foundational element of innovation in today's app-driven world is the
5+
Application Programming Interface (API). From banks, retail, and transportation
6+
to IoT, autonomous vehicles, and smart cities, APIs are a critical part of
7+
modern mobile, SaaS, and web applications and can be found in customer-facing,
8+
partner-facing, and internal applications.
9+
10+
By nature, APIs expose application logic and sensitive data such as Personally
11+
Identifiable Information (PII) and because of this, APIs have increasingly
12+
become a target for attackers. Without secure APIs, rapid innovation would be
13+
impossible.
14+
15+
Although a broader web application security risks Top 10 still makes sense, due
16+
to their particular nature, an API-specific security risks list is required.
17+
API security focuses on strategies and solutions to understand and mitigate the
18+
unique vulnerabilities and security risks associated with APIs.
19+
20+
If you're familiar with the [OWASP Top 10 Project][1], then you'll notice the
21+
similarities between both documents: they are intended for readability and
22+
adoption. If you're new to the OWASP Top 10 series, you may be better off
23+
reading the [API Security Risks][2] and [Methodology and Data][3] sections
24+
before jumping into the Top 10 list.
25+
26+
You can contribute to OWASP API Security Top 10 with your questions, comments,
27+
and ideas at our GitHub project repository:
28+
29+
* https://owasp.org/www-project-api-security/
30+
* https://github.com/OWASP/API-Security/blob/master/CONTRIBUTING.md
31+
32+
You can find the OWASP API Security Top 10 here:
33+
34+
* https://owasp.org/www-project-api-security/
35+
* https://github.com/OWASP/API-Security
36+
37+
We wish to thank all the contributors who made this project possible with their
38+
effort and contributions. They are all listed in the [Acknowledgments
39+
section][4]. Thank you!
40+
41+
[1]: https://owasp.org/www-project-top-ten/
42+
[2]: ./0x10-api-security-risks.md
43+
[3]: ./0xd0-about-data.md
44+
[4]: ./0xd1-acknowledgments.md

‎2023/en/src/0x03-introduction.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
Introduction
2+
============
3+
4+
## Welcome to the OWASP API Security Top 10 - 2023!
5+
6+
Welcome to the second edition of the OWASP API Security Top 10!
7+
8+
This awareness document was first published back in 2019. Since then, the API
9+
Security industry has flourished and become more mature. We strongly believe
10+
this work has positively contributed to it, due to it being quickly adopted as
11+
an industry reference.
12+
13+
APIs play a very important role in modern application architecture. But since
14+
innovation has a different pace than creating security awareness, we believe
15+
it's important to focus on creating awareness for common API security
16+
weaknesses.
17+
18+
The primary goal of the OWASP API Security Top 10 is to educate those involved
19+
in API development and maintenance, for example, developers, designers,
20+
architects, managers, or organizations. You can know more about the API Security
21+
Project visiting [the project page][1].
22+
23+
If you're not familiar with the OWASP top 10 series, we recommend checking at
24+
least the following top 10 projects:
25+
26+
* [OWASP Cloud-Native Application Security Top 10][2]
27+
* [OWASP Desktop App Security Top 10][3]
28+
* [OWASP Docker Top 10][4]
29+
* [OWASP Low-Code/No-Code Top 10][5]
30+
* [OWASP Machine Learning Security Top Ten][6]
31+
* [OWASP Mobile Top 10][7]
32+
* [OWASP TOP 10][8]
33+
* [OWASP Top 10 CI/CD Security Risks][9]
34+
* [OWASP Top 10 Client-Side Security Risks][10]
35+
* [OWASP Top 10 Privacy Risks][11]
36+
* [OWASP Serverless Top 10][12]
37+
38+
None of the projects replaces another: if you're working on a mobile application
39+
powered by a back-end API, you're better off reading both the corresponding top
40+
10's. The same is valid if you're working on a web or desktop application
41+
powered by APIs.
42+
43+
In the [Methodology and Data][13] section, you can read more about how this
44+
edition was created. For now, we encourage everyone to contribute with
45+
questions, comments, and ideas at our [GitHub repository][14] or
46+
[Mailing list][15].
47+
48+
[1]: https://owasp.org/www-project-api-security/
49+
[2]: https://owasp.org/www-project-cloud-native-application-security-top-10/
50+
[3]: https://owasp.org/www-project-desktop-app-security-top-10/
51+
[4]: https://owasp.org/www-project-docker-top-10/
52+
[5]: https://owasp.org/www-project-top-10-low-code-no-code-security-risks/
53+
[6]: https://owasp.org/www-project-machine-learning-security-top-10/
54+
[7]: https://owasp.org/www-project-mobile-top-10/
55+
[8]: https://owasp.org/www-project-top-ten/
56+
[9]: https://owasp.org/www-project-top-10-ci-cd-security-risks/
57+
[10]: https://owasp.org/www-project-top-10-client-side-security-risks/
58+
[11]: https://owasp.org/www-project-top-10-privacy-risks/
59+
[12]: https://owasp.org/www-project-serverless-top-10/
60+
[13]: ./0xd0-about-data.md
61+
[14]: https://github.com/OWASP/API-Security
62+
[15]: https://groups.google.com/a/owasp.org/forum/#!forum/api-security-project

‎2023/en/src/0x04-release-notes.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
Release Notes
2+
=============
3+
4+
This is the second edition of the OWASP API Security Top 10 edition, exactly
5+
four years after its first release. A lot has changed in the API (security)
6+
scene. API traffic increased at a fast pace, some API protocols gained a lot
7+
more traction, many new API security vendors/solutions have popped up, and, of
8+
course, attackers have developed new skills and techniques to compromise
9+
APIs. It was about time to get the list of the ten most critical API security
10+
risks updated.
11+
12+
With a more mature API security industry, for the first time, there was [a
13+
public call for data][1]. Unfortunately, no data was contributed, but based on
14+
the project's team experience, careful API security specialist review, and
15+
community feedback on the release candidate, we built this new list. In the
16+
[Methodology and Data section][2], you'll find more details about how this
17+
version was built. For more details about the security risks please refer to the
18+
[API Security Risks section][3].
19+
20+
The OWASP API Security Top 10 2023 is a forward-looking awareness document for
21+
a fast pace industry. It does not replace other TOP 10's. In this edition:
22+
23+
* We've combined Excessive Data Exposure and Mass Assignment focusing on the
24+
common root cause: object property level authorization validation failures.
25+
* We've put more emphasis on resource consumption, over focusing on the pace
26+
they are exhausted.
27+
* We've created a new category "Lack of Protection from Automated Threats" to
28+
address new threats, including most of those that can be mitigated using rate
29+
limiting.
30+
* We added "Unsafe Consumption of APIs" to address something we've started
31+
seeing: attackers have started looking for a target's integrated services to
32+
compromise those, instead of hitting the APIs of their target directly. This
33+
is the right time to start creating awareness about this increasing risk.
34+
35+
APIs play an increasingly important role in modern microservices architecture,
36+
Single Page Applications (SPAs), mobile apps, IoT, etc. The OWASP API Security
37+
Top 10 is a required effort to create awareness about modern API security
38+
issues.
39+
40+
This update was only possible due to the great effort of several volunteers,
41+
listed in the [Acknowledgments][4] section.
42+
43+
Thank you!
44+
45+
[1]: https://owasp.org/www-project-api-security/announcements/cfd/2022/
46+
[2]: ./0xd0-about-data.md
47+
[3]: ./0x10-api-security-risks.md
48+
[4]: ./0xd1-acknowledgments.md

‎2023/en/src/0x10-api-security-risks.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
API Security Risks
2+
==================
3+
4+
The [OWASP Risk Rating Methodology][1] was used to do the risk analysis.
5+
6+
The table below summarizes the terminology associated with the risk score.
7+
8+
| Threat Agents | Exploitability | Weakness Prevalence | Weakness Detectability | Technical Impact | Business Impacts |
9+
| :-: | :-: | :-: | :-: | :-: | :-: |
10+
| API Specific | Easy: **3** | Widespread **3** | Easy **3** | Severe **3** | Business Specific |
11+
| API Specific | Average: **2** | Common **2** | Average **2** | Moderate **2** | Business Specific |
12+
| API Specific | Difficult: **1** | Difficult **1** | Difficult **1** | Minor **1** | Business Specific |
13+
14+
**Note**: This approach does not take the likelihood of the threat agent into
15+
account. Nor does it account for any of the various technical details associated
16+
with your particular application. Any of these factors could significantly
17+
affect the overall likelihood of an attacker finding and exploiting a particular
18+
vulnerability. This rating does not take into account the actual impact on your
19+
business. Your organization will have to decide how much security risk from
20+
applications and APIs the organization is willing to accept given your culture,
21+
industry, and regulatory environment. The purpose of the OWASP API Security Top
22+
10 is not to do this risk analysis for you. Since this edition is not
23+
data-driven, prevalence results from a consensus among the team members.
24+
25+
## References
26+
27+
### OWASP
28+
29+
* [OWASP Risk Rating Methodology][1]
30+
* [Article on Threat/Risk Modeling][2]
31+
32+
### External
33+
34+
* [ISO 31000: Risk Management Std][3]
35+
* [ISO 27001: ISMS][4]
36+
* [NIST Cyber Framework (US)][5]
37+
* [ASD Strategic Mitigations (AU)][6]
38+
* [NIST CVSS 3.0][7]
39+
* [Microsoft Threat Modeling Tool][8]
40+
41+
[1]: https://owasp.org/www-project-risk-assessment-framework/
42+
[2]: https://owasp.org/www-community/Threat_Modeling
43+
[3]: https://www.iso.org/iso-31000-risk-management.html
44+
[4]: https://www.iso.org/isoiec-27001-information-security.html
45+
[5]: https://www.nist.gov/cyberframework
46+
[6]: https://www.asd.gov.au/infosec/mitigationstrategies.htm
47+
[7]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
48+
[8]: https://www.microsoft.com/en-us/download/details.aspx?id=49168

‎2023/en/src/0x11-t10.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
OWASP Top 10 API Security Risks – 2023
2+
======================================
3+
4+
| Risk | Description |
5+
| ---- | ----------- |
6+
| API1:2023 - Broken Object Level Authorization | APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface of Object Level Access Control issues. Object level authorization checks should be considered in every function that accesses a data source using an ID from the user. |
7+
| API2:2023 - Broken Authentication | Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user's identities temporarily or permanently. Compromising a system's ability to identify the client/user, compromises API security overall. |
8+
| API3:2023 - Broken Object Property Level Authorization | This category combines [API3:2019 Excessive Data Exposure][1] and [API6:2019 - Mass Assignment][2], focusing on the root cause: the lack of or improper authorization validation at the object property level. This leads to information exposure or manipulation by unauthorized parties. |
9+
| API4:2023 - Unrestricted Resource Consumption | Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage. Other resources such as emails/SMS/phone calls or biometrics validation are made available by service providers via API integrations, and paid for per request. Successful attacks can lead to Denial of Service or an increase of operational costs. |
10+
| API5:2023 - Broken Function Level Authorization | Complex access control policies with different hierarchies, groups, and roles, and an unclear separation between administrative and regular functions, tend to lead to authorization flaws. By exploiting these issues, attackers can gain access to other users’ resources and/or administrative functions. |
11+
| API6:2023 - Server Side Request Forgery | Server-Side Request Forgery (SSRF) flaws can occur when an API is fetching a remote resource without validating the user-supplied URI. This enables an attacker to coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall or a VPN. |
12+
| API7:2023 - Security Misconfiguration | APIs and the systems supporting them typically contain complex configurations, meant to make the APIs more customizable. Software and DevOps engineers can miss these configurations, or don't follow security best practices when it comes to configuration, opening the door for different types of attacks. |
13+
| API8:2023 - Lack of Protection from Automated Threats | APIs vulnerable to this risk expose a business flow - such as buying a ticket, or posting a comment - without compensating for how the functionality could harm the business if used excessively in an automated manner. This doesn't necessarily come from implementation bugs. |
14+
| API9:2023 - Improper Inventory Management | APIs tend to expose more endpoints than traditional web applications, making proper and updated documentation highly important. A proper inventory of hosts and deployed API versions also are important to mitigate issues such as deprecated API versions and exposed debug endpoints. |
15+
| API10:2023 - Unsafe Consumption of APIs | Developers tend to trust data received from third-party APIs more than user input, and so tend to adopt weaker security standards. In order to compromise APIs, attackers go after integrated third-party services instead of trying to compromise the target API directly. |
16+
17+
[1]: https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa3-excessive-data-exposure.md
18+
[2]: https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md
19+
[3]: https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa4-lack-of-resources-and-rate-limiting.md

0 commit comments

Comments
 (0)