API10:2023 — Unsafe Consumption of APIs

Slide 9 · Two Attack Patterns

Supply chain compromise and redirect exploitation — two paths through the same trust boundary.

Both patterns enter the target system through a channel where validation was deliberately skipped.

Pattern 1: Third-Party Compromise

Attacker compromises a vendor’s CDN, API, or data pipeline

Malicious payload is embedded in the vendor’s response or script

Consuming API processes the malicious data without validation

Payload executes: card skimmer, SQL injection, XSS, Log4Shell

All consuming APIs are affected simultaneously

Pattern 2: Redirect Exploitation (SSRF via Trust)

Third-party API returns a redirect URL in its response

Attacker compromises or impersonates the third-party to control the redirect target

Consuming API follows the redirect server-side — trusting the third-party’s direction

Redirect targets internal URL: cloud metadata, admin API, internal service

Consuming API reaches internal systems it should never reach

The distinguishing feature

In a direct SSRF attack (API7), the attacker controls the URL through their own request to the target API. In the API10 redirect pattern, the URL comes from a trusted third-party response — and the consuming API follows it because it trusts the source. The underlying mechanism (server-side URL fetch reaching an internal target) is the same; the delivery path is different and bypasses the SSRF-specific input validation applied to direct requests.

← Back Pattern 1 mechanics →