Insecure APIs in cloud services
In today’s world, modern developments are based on APIs to communicate between system components. The fact that APIs are publicly exposed makes them an easy target for attackers trying to access a system and cause damage.
Some common examples of attacks exploiting insecure APIs are as follows:
- Due to a lack of input validation, an attacker can misuse an exposed API and inject malicious code through the API into a backend database
- Due to a lack of input validation, an attacker can perform an SQL injection through an exposed API and exfiltrate customer data from a retail site
- Due to a lack of application access control mechanisms, an attacker can use an API to penetrate a cloud service by using a low-privilege account
- An attacker located an API key stored in an open source code repository and was able to run remote commands against an internal system, using the permissions that the API key had
