API-9: Improper Inventory Management

What is Improper Inventory Management?

Improper Inventory Management occurs when an organization fails to maintain an accurate inventory of its APIs, versions, endpoints, hosts, or documentation. As a result, outdated, undocumented, deprecated, or forgotten APIs remain exposed and accessible, creating opportunities for attackers to discover and exploit them.

Common Examples

1. Exposed Old API Version
2. Public Test Environment
3. Deprecated Endpoint
4. Exposed API Documentation

Attack Scenario

In this application, I notice that the deprecated API version (v1) remained operational and accessible, potentially increasing the application’s attack surface.

Mitigation

• Maintain a complete inventory of all APIs, endpoints, versions, hosts, and environments.
• Remove deprecated APIs and disable unused endpoints as soon as they are no longer required.
• Secure all environments, including development, testing, and staging, with the same security controls as production.
• Restrict access to internal APIs and API documentation using authentication and network controls.
• Review API documentation to ensure it does not expose sensitive or internal functionality.