Security Misconfiguration (API)
APIs expose excessive information through open CORS policies, verbose error messages, missing security headers, or default configurations that were never hardened.
How It Works
API security misconfiguration covers a wide range of issues: permissive CORS headers allowing any origin, verbose error responses that leak stack traces and internal paths, missing TLS, default admin credentials, unnecessary HTTP methods enabled, and lack of security headers. These misconfigurations are often the result of using framework defaults in production. Attackers use automated scanners to probe for these issues at scale, gathering intelligence for more targeted attacks.
const app = express();
app.use(cors());
app.use((err, req, res, next) => {
res.status(500).json({
error: err.message,
stack: err.stack,
query: req.query
});
});const app = express();
app.use(cors({ origin: process.env.ALLOWED_ORIGIN }));
app.use(helmet());
app.use((err, req, res, next) => {
logger.error({ err, requestId: req.id });
res.status(500).json({ error: 'Internal server error' });
});Real-World Example
In 2022, Optus (Australia's second-largest telecom) exposed 9.8 million customer records through an API that had no authentication and was publicly accessible. The API endpoint was discoverable because error messages revealed internal paths and API structure.
How to Prevent It
- Restrict CORS to specific trusted origins only
- Return generic error messages — log details server-side
- Use security headers middleware like Helmet.js
- Disable unnecessary HTTP methods (TRACE, OPTIONS where not needed)
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Broken Object Level Authorization (BOLA)
highAPI endpoints don't verify that the requesting user owns the resource they're accessing — allowing attackers to access other users' data by changing object IDs.
Broken Authentication (API)
highAPI authentication mechanisms are weak or improperly implemented — JWT without proper validation, tokens not in httpOnly cookies, or missing token expiration.
Broken Object Property Level Authorization
mediumAPI allows users to read or modify object properties they shouldn't have access to — mass assignment, excessive data exposure, or missing field-level access control.
Unrestricted Resource Consumption
mediumAPI endpoints without rate limiting, pagination, or resource limits — allowing attackers to exhaust server resources, rack up costs, or extract large datasets.