New Rule: Check for /admin/ in the path and see if its the same securityScheme as non admin paths.

[philsturgeon]

In API5:2019 — Broken function level authorization of OWASP API Security they talk about a bunch of things which are pretty tricky to detect in OpenAPI, but not entriely impossible.

Context

Is the API Vulnerable?

The best way to find broken function level authorization issues is to perform deep analysis of the authorization mechanism, while keeping in mind the user hierarchy, different roles or groups in the application, and asking the following questions:

• Can a regular user access administrative endpoints?
• Can a user perform sensitive actions (e.g., creation, modification, or erasure) that they should not have access to by simply changing the HTTP method (e.g., from GET to DELETE)?
• Can a user from group X access a function that should be exposed only to users from group Y, by simply guessing the endpoint URL and parameters (e.g., /api/v1/users/export_all)?

Don’t assume that an API endpoint is regular or administrative only based on the URL path.

While developers might choose to expose most of the administrative endpoints under a specific relative path, like api/admins, it’s very common to find these administrative endpoints under other relative paths together with regular endpoints, like api/users.

We can't guarentee an operation isnt admin related (as it says dont assume on path alone) but we can catch common case where the path does have /admin/ and warn about that.

Current Behavior

Currently no efforts are made for anything in API5:2019.

Expected Behavior

Any path containing /admin/ should error if the securityScheme is the same for non /admin/ paths.

Possible Solution(s)

Probably needs a custom function to check what securitySchemes exist. They either need to be a different securityScheme.Foo or securityScheme.Bar.

It's possible that both could be securityScheme.Foo if type: oauth2 and they have different scopes.

  "securitySchemes": {
    "api_key": {
      "type": "apiKey",
      "name": "api_key",
      "in": "header"
    },
    "petstore_auth": {
      "type": "oauth2",
      "flows": {
        "implicit": {
          "authorizationUrl": "https://example.org/api/oauth/dialog",
          "scopes": {
            "write:pets": "modify pets in your account",
            "read:pets": "read your pets"
          }
        }
      }
    }
  }

[github-actions]

🎉 This issue has been resolved in version 2.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀