Poisoned Pipeline / Techniques / T0123
Exposed internal API
Exposed internal API attack technique is when an attacker targets a publicly accessible API intended for internal use only, providing an entry point for accessing sensitive information or systems within an organization.
This is a common issue when API endpoints are mistakenly exposed to the public or not properly secured, which can allow attackers to gain access to sensitive data or systems.
Attackers can discover exposed internal APIs by using automated tools to scan public IP addresses or by reverse-engineering mobile applications or browser extensions.
Once they have identified a vulnerable API, attackers can use it to gather information, launch attacks, or steal sensitive data.
The impact of this attack can be severe as attackers can bypass traditional security controls and gain access to internal systems or data that are not meant to be publicly accessible.
Where this idea came from
Recorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.
Mitigations
- M1230 Secure API access control
- M1231 Implement Proper API documentation
- M1232 Implement API endpoint hardening
- M1550 Implement strict access control for clouds
- M1720 Implement regular patches and updates
Detections
- D1230 Implement API endpoint monitoring
- D1231 Implement API security testing
- D1510 Implement Intrusion Detection System and anti-malware