API10—Unsafe Consumption of APIs

An API integrates with a third-party service provider to enrich user-provided business addresses. When an address is supplied by the end user, it is sent to the third-party service and the returned data is then stored in a local SQL-enabled database. An attacker uses the third-party service to store an SQL injection payload associated with a business they created. The malicious payload is later retrieved by the vulnerable API, which trusts the third-party data and stores it without validation, leading to SQL injection.

An API integrates with a third-party service provider to store sensitive user medical information. Data is sent over a secure connection using an HTTP request like: POST /user/store_genome_data. An attacker compromises the third-party server and makes it respond with a 308 Permanent Redirect to an attacker-controlled server. Because the API blindly follows the third-party redirect, it repeats the exact same request including the user's sensitive data to the attacker's server.

An attacker creates a source code repository named '; drop db;--. When an integration application fetches data from the malicious repository, it uses the repository name in an SQL query without proper sanitization, treating it as trusted input from the well-known source code hosting provider. The SQL injection payload executes, dropping the database.