API Security 101: Improper Assets Management
Tags: api, infosec, softwareengineering, cybersecurity
Published: 2021-10-19 22:53:30

---
title: API Security 101: Improper Assets Management
published: true
date: 2021-09-14 14:33:12 UTC
tags: api,infosec,softwareengineering,cybersecurity
canonical_url: https://blog.shiftleft.io/api-security-101-improper-assets-management-825bfe9ea0b4
---

#### And why missing documentation is a vulnerability.

![](https://cdn-images-1.medium.com/max/1024/0*PGDMeB2jm61GnMzC)<figcaption>Photo by <a href="https://unsplash.com/@martinadams?utm_source=medium&amp;utm_medium=referral">Martin Adams</a> on <a href="https://unsplash.com?utm_source=medium&amp;utm_medium=referral">Unsplash</a></figcaption>

You’ve probably heard of the OWASP top ten or the top ten vulnerabilities that threaten web applications. OWASP also periodically selects a list of top ten vulnerabilities that threaten APIs, called the OWASP API top ten. The current API top ten are _Broken Object Level Authorization_, _Broken User Authentication_, _Excessive Data Exposure_, _Lack of Resources & Rate Limiting_, _Broken Function Level Authorization_, _Mass Assignment_, _Security Misconfiguration_, _Injection_, _Improper Assets Management_, and _Insufficient Logging & Monitoring_. Today, let’s talk about _Improper Assets Management_, and why it’s a security issue that you should not ignore.

#### First of all, what even is _Improper Assets Management?_

Although “improper assets management” sounds complicated, it’s essentially this: not keeping track of your API endpoints. This can either be due to incomplete API documentation, or a complete lack of API documentation. But why is the lack of API documentation an issue?

An API usually has many different versions, functionalities, endpoints, and a lot of parameters that affects the behavior of that endpoint. And if you don’t keep track on all of this functionality, you become unaware of the security vulnerabilities hiding within the unknown endpoints. You cannot secure what you don’t know about.

Besides incomplete or missing documentation, inaccurate documentation is also a security issue. Even if you have documentation detailing the API endpoints, does it tell you what each endpoint does? Are there any behaviors of the endpoint that are not documented in the docs, such as accepting alternate HTTP methods? Are there any undocumented parameters that can affect the endpoint’s functionality? Inaccurate documentation can make you think that the endpoint is secure, when it is not really behaving the way you think it is.

#### Some examples

For instance, let’s say you discovered a sensitive information leak on an API endpoint. But you are unaware that an older version of the API with the same information leak vulnerability is also available to the public. So you did not mitigate the vulnerability in the older version, and attackers can still exploit the vulnerability via the older API.

Or you might want to restrict the access of some sensitive endpoints to the site’s admins. But without detailed records of each endpoint and its functionalities, you have no way of deciding which endpoints should be restricted.

Sensitive data leaks, authorization issues, the OWASP API top ten, and many other vulnerabilities often manifest themselves in an API. But you have no way to test and secure the endpoints that you don’t know about.

#### What should I do to secure my API?

The best way to prevent the security blindspots caused by improper assets management is to have detailed documentation about your API hosts, versions, endpoints, and its parameters and expected behavior. Document consistently, and document everything! Make sure that others who work on the API has access to appropriate documentation. And as always, scan your API for common vulnerabilities, and routinely audit the security of all of your API endpoints.

Improper Assets Management might not seem like an issue at first. But in the long run, it is actually extremely dangerous to not have comprehensive documentation of your API. Next time, let’s take a look at another vulnerability caused by improper documentation and management, OWASP API top ten #10, Insufficient Logging and Monitoring, and why and when it becomes an issue.

What other security concepts do you want to learn about? I’d love to know. Feel free to connect on Twitter [@vickieli7](https://twitter.com/vickieli7).

Want to learn more about application security? Take our free OWASP top ten courses here: [https://www.shiftleft.io/learn/](https://www.shiftleft.io/learn/).

* * *