API8:2023 — Security Misconfiguration

Slide 8 · Context

The broadest risk on the list — and the one that keeps growing.

API8 covers everything from one missing header to an entire admin panel exposed to the internet. Both qualify.

Why it’s broad

OWASP API Security Top 10 ranks risks by exploitability, prevalence, and impact. API8 is #8 because the individual instances vary widely in severity — a missing X-Content-Type-Options header is less severe than an unauthenticated admin panel. But the category is prevalent: nearly every API deployment has at least one misconfiguration. The aggregate risk is high even if any single instance may be low.

Lower severity (but common)

Missing X-Content-Type-Options header

Outdated TLS 1.1 still accepted

OPTIONS method returns all allowed methods

Server version disclosed in Server: header

Higher severity (less common, catastrophic)

Reflected CORS with credentials enabled

Production debug mode with stack traces

Admin console without authentication (Tesla)

Cloud storage with public read/write (Firebase)

The compounding effect

Misconfigurations compound. A verbose error message reveals the framework version. A known CVE for that version exists. The API also accepts unnecessary HTTP methods. The combination creates an attack chain where each misconfiguration makes the next one easier to exploit. This is why comprehensive configuration hardening matters — not just fixing the obvious one.

← Back How do attacks work? →