Business Logic

Uncover the details of Pynt's security tests for business logic vulnerabilities in our documentation! Learn how Pynt safeguards against critical business logic threats.

Intro

Business logic API attacks refer to a type of security threat where an attacker exploits vulnerabilities in the underlying logic of an API to achieve unauthorized access or manipulate data within a business application.

What are the common mistakes done by developers ?

In most cases Business logic issues happen when authorization is not enforced through all the flows of the application. Modern applications usually assign a non guessable identifiers to users and resources.

Consider the following example:

def get_profile(self, getprofile_request, context):
    cursor, conn = connection_to_sql(f"GET_PROFILE_BL {getprofile_request}")
    cursor.execute('select * from profiles where uid=?',(getprofile_request.uid,))
    p = cursor.fetchone()

The function get_profile accepts the User ID as uid and directly querying the database to get this user's profile without any validation that the logged in user is the same user that is represented by the uid.

How can I fix Business Logic issues ?

Ensure that only authorized users can access the API and that access is granted on a need-to-know basis. Use strong authentication methods such as multi-factor authentication and implement authorization checks at the API endpoint level.

Test cases in this category:

These test cases test the enforce of authorization between user identifiers, resource identifiers and the actual logged in users on APIs that read user related data

Test case	OWASP	CWE
[BL001] User data leakage to other users - Resource-ID authorization	API1 OWASP API Top 10	CWE-285, CWE-284, CWE-639
[BL002] User data leakage to other users - User-ID authorization	API1 OWASP API Top 10	CWE-285, CWE-284, CWE-639
[BL003] User data leakage to other users - Resource-ID and User-ID authorization	API1 OWASP API Top 10	CWE-285, CWE-284, CWE-639
[BL004] User data leakage to other users - credentials authorization	API1 OWASP API Top 10	CWE-285, CWE-284, CWE-639

These test cases test the enforce of authorization between user identifiers, resource identifiers and the actual logged in users on APIs that write user related data

Test case	OWASP	CWE
[BL005] User data manipulation by other users - Resource-ID authorization	API5 OWASP Top 10	CWE-285
[BL006] User data manipulation by other users - User-ID authorization	API5 OWASP Top 10	CWE-285
[BL007] User data manipulation by other users - Resource-ID and User-ID authorization	API5 OWASP Top 10	CWE-285
[BL008] User data manipulation by other users - credentials authorization	API5 OWASP Top 10	CWE-285

This test case try to guess values of user Identifiers with a numeric structure

Test case	OWASP	CWE
[BL009] Guessable resource identifier	API1 OWASP Top 10