API9:2023Improper Inventory Management
Slide 10 of 28
Part 2 · How It WorksSlide 10
Slide 10 · Pattern 1 Mechanics
Version discovery → Weaker controls → Bypass the v2 security
Step by step: how an attacker finds a forgotten API version and uses it to bypass current security.
THE SETUP
A user API where v2 added authentication. v1 never did.

v1 endpoint: GET /api/v1/users/{id} — originally built for internal use, returns full user profile. No auth required (“it was internal”). Never decommissioned.

v2 endpoint: GET /api/v2/users/{id} — same data, authentication required, returns only fields the requesting user is authorized to see. Properly secured.

1️⃣
Attacker fuzzes the API path
Sends requests to /api/v1/, /api/v2/, /api/v3/, /api/legacy/, /api/old/, /v1/, /v2/. Automated tools (ffuf, dirsearch) try hundreds of variations in seconds. /api/v1/users/1 returns HTTP 200 with a user profile — no auth required.
2️⃣
Attacker confirms v1 has no auth
Sends request with no Authorization header. Gets full user data. Tries an invalid token. Still gets data. v1 ignores authentication entirely — the auth middleware was added in v2’s routing layer and doesn’t apply to v1 routes.
3️⃣
Attacker enumerates all users through v1
Iterates /api/v1/users/1 through /api/v1/users/100000. Gets email addresses, phone numbers, hashed passwords, and account details for every user — without ever touching v2’s auth layer. The security team’s v2 hardening work is completely bypassed.
← Back Real incident: Facebook →
📄 View sources