API requests that bypass access control checks typically fall under the category ofBroken Access Control.
This vulnerability occurs when the API fails to enforce restrictions on authenticated users, allowing them to access data or functionality they are not authorized to use.
* Example:An API endpoint that does not properly verify user roles might allow a standard user to perform admin actions.
* Related Issues:Insecure direct object references (IDOR), where APIs expose objects without sufficient authorization checks, often lead to broken access control.
* Impact:Attackers can exploit this to gain unauthorized access, modify data, or escalate privileges.
Incorrect Options:
* A. Insecure direct object reference:This is a type of broken access control, but the broader category is more appropriate.
* B. Input injection:Typically related to injection or command injection, not directly related to bypassing access controls.
* C. Forced browsing:Involves accessing unlinked or unauthorized resources via predictable URLs but is not specific to API vulnerabilities.
Exact Extract from CCOA Official Review Manual, 1st Edition:
Refer to Chapter 7, Section "API Security," Subsection "Common API Vulnerabilities" - Broken access control remains a primary issue when API endpoints fail to enforce proper access restrictions.