What is Security Misconfiguration?
No. 8 on the 2023 OWASP API Top 10 vulnerabilities list is security misconfiguration. Vulnerability 8 is a catch-all for any design flaws in an API that could make it vulnerable.
OWASP says of this flaw, “Attackers will often attempt to find unpatched flaws, common endpoints, services running with insecure default configurations, or unprotected files and directories to gain unauthorized access or knowledge of the system. Most of this is public knowledge and exploits may be available.”
Key Takeaways
- Security misconfiguration is #8 on the OWASP API Security Top 10 2023 and serves as a catch-all for any design or configuration flaw, including missing security headers, exposed admin interfaces, insecure defaults, and undocumented endpoints that make an API vulnerable
- Missing HTTP response headers like Cache-Control can inadvertently cause private API data to be cached by browsers, making sensitive content retrievable from the file system without any active exploitation of application logic
- Many enterprises run APIs they didn't develop themselves or have lost institutional knowledge about, and doing rigorous penetration testing and strict allowlisting of known-good interaction paths are the most realistic defenses for inherited systems
- Security misconfiguration is rarely a standalone attack; adversaries typically use it as a first step in a multi-phase campaign, chaining it with botnet-driven reconnaissance and credential attacks to build toward a more damaging objective
- ThreatX by A10 Networks addresses misconfiguration exploitation in real time by proxying all inbound API traffic using behavioral fingerprinting and tarpitting to identify and block attacker patterns before they cross a configurable risk threshold
How Do Security Misconfiguration-related Exploits Work?
OWASP gives this example:
A social network website offers a “direct message” feature that allows users to keep private conversations. To retrieve new messages for a specific conversation, the website issues the following API request (user interaction is not required):
GET /dm/user_updates.json?conversation_id=1234567&cursor=GRlFp7LCUAAAA Because the API response does not include the Cache-Control HTTP response header, private conversations end up cached by the web browser, allowing malicious actors to retrieve them from the browser cache files in the filesystem.
An attacker could also find new endpoints on the API that are used only by the DevOps team and are not documented.
Another example is administrative web interfaces that are supposed to be locked down but are sometimes left exposed. phpMyAdmin is notorious on this front.
How to Prevent Security Misconfiguration
Having a strong security mindset at the outset of development can help to identify the possible security misconfiguration vectors upfront and to develop monitoring/alerting scripts to ensure those misconfigurations never occur in production. This assumes your development team has strong security chops or is working closely and effectively with a security group.
However, the fact is that many enterprises are running APIs they didn’t even develop in the first place. Even if they did develop the APIs, the original developers might be long gone, and the tribal knowledge of security misconfiguration vectors is nowhere to be found. In this case, look to rigorous pen testing and aggressive restraints that limit the interface to only the known-good interaction paths.
How Our Approach Is Unique
Real-time Blocking
Some API security solutions simply highlight potential API vulnerabilities, leaving security teams to investigate and recommend code changes. Other API solutions can identify an attacking IP but require security teams to try to model the complex behavior in a third-party WAF (or try to block one IP at a time after the fact). ThreatX by A10 Networks doesn’t just show API vulnerabilities or attempted attacks, it also blocks API attacks in real time. ThreatX proxies and scans all inbound API traffic, identifying and blocking attacks.
ThreatX recognizes attacker behavior indicative of an attempt to exploit security misconfigurations, then flags and watches that user. This real-time monitoring enables ThreatX to execute advanced threat engagement techniques, such as IP interrogation, fingerprinting, and tarpitting. When a series of user interactions cross our default (or your customized) risk threshold, the attack is blocked.
Step One of N…
In many cases, attackers aren’t just going to attack by attempting to exploit a security misconfiguration; they’re going to string together a series of attacks over time, often using federated and sophisticated botnets. Countering this approach requires the ability to correlate attack traffic across multiple IPs, the use of advanced bot protection, and the ability to detect identifiers and techniques to associate the traffic to a unique attacker. Rather than requiring a single, significantly risky event or identifying a known signature, ThreatX analyzes behaviors from multiple vantage points. This allows the ThreatX platform to identify and block more threats, more accurately than competing API security tools.
Fewer False Positives
As risk rises, ThreatX immediately blocks an attack. ThreatX blocking modes are designed to block malicious requests and deter suspicious entities from attacking APIs, while allowing benign traffic and real users through. Legacy WAFs struggle with false positives because they only make blocking decisions based on rules, but attackers and legitimate users don’t always follow the rules. Sometimes a legitimate user who forgot their password looks like an attacker, and sometimes an attacker cycling through usernames and passwords looks like a legitimate user. ThreatX can tell the difference.
FAQs
Tarpitting is a defensive technique that deliberately slows down responses to suspicious requests, increasing the time and cost for attackers to probe or exploit an API without outright blocking them immediately. This gives the security platform time to gather more behavioral data, confirm malicious intent, and engage the attacker while keeping them occupied and away from legitimate traffic.
An undocumented endpoint is a known API endpoint that simply lacks public documentation. It exists intentionally but wasn’t included in API specs. A shadow API is an endpoint that is entirely unknown to the current security and development teams, often because it was created by a different team, a third-party integration, or a legacy system, and has never been formally inventoried or secured.
Legacy WAFs make blocking decisions based on static rules and known signatures. When legitimate user behavior happens to resemble a rule pattern, such as a user making multiple failed login attempts, the WAF blocks it. Behavioral platforms build entity-level risk profiles over time, distinguishing genuine users from attackers based on the full context of their activity rather than individual request characteristics.
IP interrogation involves actively probing suspicious IP addresses to gather additional signals about their nature, such as whether they belong to known hosting providers, VPNs, Tor exit nodes, or residential networks. Combined with TLS fingerprinting and behavioral analysis, it helps security platforms build a more complete attacker profile and improve the accuracy of blocking decisions across rotating IP pools.
For inherited APIs, the primary controls are aggressive penetration testing to map undocumented endpoints and misconfigured behaviors, strict API gateway policies that allowlist only known-good request patterns, and continuous traffic monitoring to detect anomalous access patterns. Since the original developers’ knowledge is unavailable, external behavioral detection tools that don’t rely on prior documentation of the API’s intended behavior are particularly valuable.