Detectors

OWASP API Security Detectors

OpenApiGuard implements modular security rules strictly aligned with the OWASP API Security Top 10 (2023) standard.

---

Detector Catalog

1. Broken Object Level Authorization (BOLA) • API1:2023

• Identifier: DetectorId.BOLA | CWE: CWE-639 | Default Severity: CRITICAL
• Attack Mechanism: Tests whether an authenticated user can access, modify, or delete resources belonging to another user.
• Test Strategy:
  1. Identifies endpoints with identifier parameters (e.g., /{userId}, /{accountId}).
  2. Executes the request using User A's authorization token while supplying User B's identifier (seedData.targetId).
  3. Flagged if the endpoint returns 200 OK or 204 No Content instead of 403 Forbidden or 404 Not Found.

---

2. Broken Authentication • API2:2023

• Identifier: DetectorId.AUTH | CWE: CWE-287 | Default Severity: HIGH
• Attack Mechanism: Tests endpoints declaring security requirements against missing, malformed, or expired authentication tokens.
• Test Strategy:
  1. Injects requests without the Authorization header.
  2. Injects invalid signatures, empty strings, and malformed JWT tokens.
  3. Flagged if a protected endpoint responds with 200 OK rather than 401 Unauthorized.

---

3. Broken Object Property Level Authorization • API3:2023

• Identifier: DetectorId.BOPLA | CWE: CWE-915 | Default Severity: HIGH
• Attack Mechanism: Evaluates Mass Assignment and Excessive Data Exposure.
• Test Strategy:
  • Mass Assignment: Injects sensitive administration attributes (e.g., "role": "ADMIN", "isVerified": true, "balance": 99999) into POST/PUT/PATCH payloads. Flagged if the server persists or accepts these fields.
  • Excessive Data Exposure: Inspects response payloads for unmasked PII, password hashes, or internal database metadata that should not be exposed to callers.

---

4. Unrestricted Resource Consumption • API4:2023

• Identifier: DetectorId.DOS | CWE: CWE-770 | Default Severity: MEDIUM
• Attack Mechanism: Tests pagination parameters and payload size constraints.
• Test Strategy:
  1. Identifies query parameters controlling pagination limits (e.g., limit, size, pageSize).
  2. Sends requests with excessively large integer values (e.g., limit=10000000) and negative bounds (limit=-1).
  3. Flagged if the endpoint attempts to process the payload without capping the page size, exposing the database to memory exhaustion.

---

5. Broken Function Level Authorization (BFLA) • API5:2023

• Identifier: DetectorId.BFLA | CWE: CWE-285 | Default Severity: CRITICAL
• Attack Mechanism: Checks whether regular user accounts can access privileged or administrative routes.
• Test Strategy:
  1. Scans the OpenAPI specification for administrative paths (e.g., /admin/**, /management/**, /internal/**).
  2. Sends requests to these endpoints using standard USER credentials or unauthenticated probes.
  3. Flagged if privileged endpoints execute without returning 403 Forbidden.

---

6. Security Misconfiguration • API8:2023

• Identifier: DetectorId.MISCONFIG | CWE: CWE-16 | Default Severity: MEDIUM
• Attack Mechanism: Audits transport security, defensive HTTP headers, and CORS configurations.
• Test Strategy:
  • Inspects responses for defensive headers: X-Content-Type-Options: nosniff, Strict-Transport-Security, Content-Security-Policy.
  • Verifies that Access-Control-Allow-Origin: * is not combined with Access-Control-Allow-Credentials: true.
  • Flags detailed stack traces or debug exception dumps in 500 error responses.