API10:2023 Unsafe Consumption of APIs
The server fetches from a third party and passes the response to clients, or uses it in security-sensitive logic, without checking its content or origin. A compromised or misbehaving upstream then controls what your API returns.
What Vulkro detects
Outbound HTTP client responses that flow into the response body or into authorization logic without a schema validation, allowlist or signature check.
Non-compliant code
// Express: upstream response passed straight through
app.get('/exchange-rate', async (req, res) => {
const upstream = await fetch('https://rates.example.com/usd');
const json = await upstream.json();
res.json(json); // no schema check; upstream could inject anything
});
Compliant code
// Express: schema-validate the upstream payload
const RateSchema = z.object({ usd: z.number(), eur: z.number() });
app.get('/exchange-rate', async (req, res) => {
const upstream = await fetch('https://rates.example.com/usd');
const parsed = RateSchema.parse(await upstream.json()); // throws on shape drift
res.json(parsed);
});
References
See also: Confidence model.
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.