API6:2023 Unrestricted Access to Sensitive Business Flows

Business flows (ticket purchase, signup, password reset, money transfer) accept automation with no throttle, CAPTCHA or behavioural challenge. Bots can then scalp stock, mass-create accounts or enumerate users.

What Vulkro detects

A heuristic: handler names matching purchase|checkout|signup|reset_password|transfer with no rate-limiting or CAPTCHA middleware in the route pipeline.

Non-compliant code

# FastAPI: password reset with no throttle
@app.post('/auth/reset')
async def reset(email: str):
    user = await User.get_by_email(email)
    if user:
        await send_reset_email(user)
    return {'ok': True}  # bots can iterate the user table

Compliant code

# FastAPI: slowapi throttle plus CAPTCHA
@app.post('/auth/reset')
@limiter.limit('3/hour')
async def reset(email: str, captcha: str = Depends(verify_captcha)):
    user = await User.get_by_email(email)
    if user:
        await send_reset_email(user)
    return {'ok': True}

References

• CWE-840
• OWASP API6:2023

See also: Confidence model.

---

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.