1. An attacker sends requests to /api/v1/users/1 with no authentication header and receives full user data. The production API at /api/v2/users/1 requires authentication. What API9 failure enabled this?
Correct. v1 still answered requests but predated the authentication middleware added in v2. Both versions were live simultaneously — the attacker called the one without auth. This is the core version sprawl attack pattern in API9.
Not quite. The problem is that v1 and v2 were running simultaneously with different security models. v1 had no authentication requirement — because it predated auth being added. The attacker bypassed v2’s auth entirely by calling v1 instead.
2. A security team patches a BOLA vulnerability in /api/v2/. Three months later, an attacker exploits the same BOLA vulnerability through /api/v1/. What mitigation would have prevented this?
Correct. MIT 04 requires applying identical security controls to all active versions. If patching v1 isn’t feasible, v1 should be blocked at the network layer (MIT 03) before patching v2 — not left running unpatched after the fix goes into v2.
The issue isn’t v2’s controls — v2 was patched. The problem is v1 remained accessible with the original vulnerability. MIT 04 requires patching all active versions; MIT 03 blocks old versions at the network layer. Either approach would have prevented the v1 exploit.
3. An attacker finds staging-api.company.com by checking certificate transparency logs and discovers it contains real production data with no authentication. Which two OWASP API9 mitigations would have prevented this breach?
Correct. MIT 05 ensures non-production environments are not internet-accessible. MIT 01 ensures the inventory tracks each environment’s accessibility so gaps can be identified. Certificate transparency logs make any subdomain discoverable — the only fix is ensuring it’s not internet-accessible in the first place.
Rate limiting and CORS wouldn’t stop someone from accessing staging directly — the problem is that staging was internet-accessible at all. MIT 05 (environment separation) removes the environment from the internet. MIT 01 (complete inventory) ensures the team knows which environments are internet-facing.
4. In the Facebook / Cambridge Analytica incident, what was the specific API9 failure that enabled the data harvest?
Correct. Facebook removed the friends permission in Graph API v2 (2014). But v1 remained operational for apps registered before April 2014. Cambridge Analytica’s app, registered in 2013, used v1’s friends permission to harvest 87 million profiles from 270,000 installs. The privacy fix existed — in v2. v1 stayed live.
The breach didn’t involve hacking in the traditional sense. The friends permission was a legitimate v1 API feature. Facebook removed it in v2 but kept v1 operational. Cambridge Analytica used a pre-v2 registered app to call the v1 API — which still had the friends permission. API9 at scale.
5. Which mitigation creates structural enforcement of API inventory by making it impossible for a backend service to be accessible from the internet without being registered?
Correct. MIT 07 (API gateway) is the structural solution: backend services are on a private network and only accessible through the gateway. The gateway’s registered routes become the inventory. A service that isn’t registered in the gateway cannot be reached from the internet — regardless of what port it’s listening on.
Discovery scanning (MIT 06) finds gaps after the fact — it’s reactive. The API gateway (MIT 07) is structural: backend services are private and only accessible through the gateway. This makes an unregistered service unreachable from the internet by design, not by discovery.