OWASP top 10 API Security vulnerabilities – Lack of Resources and Rate Limiting

Introduction

Lack of Resources and Rate Limiting refers to the risk of APIs being overwhelmed or exhausted by excessive requests, which can lead to denial of service attacks. This can occur when APIs do not properly handle high volumes of traffic, or do not implement sufficient rate limiting to prevent excessive requests from a single source.

Risks

Some common risks associated with Lack of Resources and Rate Limiting include:

• Denial of service for legitimate users of the API
• Loss of availability for the API and the systems and services it supports
• Reputational damage for the organization due to service disruptions

Attack Scenarios

Attack scenarios for cloud applications may include:

• An attacker uses an API to send a large number of requests in a short period of time, overwhelming the API and causing it to become unavailable
• An attacker exploits a vulnerability in the API to send a high volume of requests, potentially causing a denial of service
• An attacker coordinates with other attackers to launch a distributed denial of service (DDoS) attack against an API

Vulnerable Sample Code

A vulnerable sample of code in Golang might look like this:

func getData(w http.ResponseWriter, r *http.Request) {
  // Retrieve the data from the database
  data, err := database.GetData()
  if err != nil {
    http.Error(w, "Error retrieving data", http.StatusInternalServerError)
    return
  }

  // Return the data to the user
  json.NewEncoder(w).Encode(data)
}

In this example, the API call retrieves data from a database and returns it to the caller. However, there is no rate limiting in place to prevent excessive requests from a single source, and the API does not properly handle high volumes of traffic. An attacker could exploit this vulnerability by sending a large number of requests to the API in a short period of time, potentially causing a denial of service.

Sample Attack

A sample attack payload using the curl command might look like this:

while true; do curl http://api.example.com/getdata; done

In this example, the attacker is using a loop to send an endless stream of requests to the API using curl. If the API is vulnerable to Lack of Resources and Rate Limiting, this could potentially cause a denial of service.

MITRE ATT&CK framework reference

Lack of Resources and Rate Limiting can be mapped to the Tactic: Denial of Service and the Technique: Flooding in the MITRE ATT&CK framework. This technique involves overwhelming a system or network with excessive requests, potentially causing a denial of service.

Mitigation

To mitigate the risk of Lack of Resources and Rate Limiting, organizations should ensure that their APIs are properly designed to handle high volumes of traffic and implement sufficient rate limiting to prevent excessive requests from a single source. Additionally, organizations should regularly monitor and review the performance of their APIs to identify and address any issues, and have contingency plans in place to handle unexpected spikes in traffic. Implementing proper logging and monitoring can also help to detect and respond to potential denial of service attacks.

 

Download API Security whitepaper

Our in-depth whitepaper provides valuable insights into how Prancer Security’s cutting-edge solution mitigates critical risks such as unauthorized access and data breaches, while adhering to the highest security standards.

Don’t leave your API security to chance – download our comprehensive whitepaper now and discover how Prancer Security can safeguard your organization from potential threats!