API9:2023 — Improper Inventory Management

Slide 14 · Scenario 1

v1 is “deprecated.” It still answers. It still has no auth.

The security team updated v2. The attacker calls v1. The update is irrelevant.

📄 OWASP API Security Top 10 2023 · API9:2023 Example Attack Scenarios

SCENARIO 1

Version downgrade to bypass v2 security controls

An organization runs a public API at /api/v2/. v2 requires authentication on all endpoints, enforces rate limiting, and validates all input. The security team recently applied a patch to prevent BOLA (Broken Object Level Authorization) — users can only access objects they own.

v1 (/api/v1/) was deprecated when v2 launched 18 months ago. It’s still running — the team kept it live for a “legacy partner” that never migrated. v1 predates the authentication middleware, does not validate object ownership, and was never patched when the BOLA fix went into v2.

The attacker discovers v1 by sending requests to /api/v1/, /api/v2/, and /api/v3/. v1 returns HTTP 200. The attacker sends requests to /api/v1/users/2, /api/v1/users/3 — all return full user records without authentication. The entire v2 security investment is bypassed.

Why this happens: Deprecation is a label, not a decommission. “Deprecated” means the team stopped investing in v1 — but stopped investing means stopped patching, stopped monitoring, and stopped caring. The endpoint still responds. Attacker doesn’t care about the deprecation label.

← Back Scenario 2 →