API6:2023 - Unrestricted Access to Sensitive Business Flows | Security Lab

Imagine a store policy that says "limit one free sample per customer," but a person walks in, takes a sample, steps outside, puts on a fake mustache, and walks right back in to take another—repeating this all day. In APIs, Unrestricted Access to Sensitive Business Flows happens when an endpoint exposes a legitimate business function (like buying a ticket, applying a promo code, or posting a comment) but fails to account for automated abuse.

Real attacks target the business, not just the server infrastructure. Attackers use botnets to buy up all concert tickets in three seconds, brute-force referral codes, or add all of a competitor's inventory to abandoned shopping carts so legitimate customers can't buy anything.

API6:2023 - Unrestricted Access to Sensitive Business Flows

Community Discussion