Issue 262: API incidents in Invoice Ninja, McDonald’s & Truecaller apps, Jetbrains survey, Postman data leaks
Brief
This week, we examine three recent API security incidents, uncovering valuable lessons to help you protect your APIs. We also highlight key insights from Jetbrains’ comprehensive developer survey, and explore an article on how teams inadvertently leak API keys and tokens through their Postman workspaces and what you can do about it.
Breach: Black-listing fails to block SSRF attack
A research team from Pretera has identified a critical server-side request forgery (SSRF) vulnerability in the popular invoicing software, Invoice Ninja.
The root cause of the issue lies in the use of a blacklisting approach to mitigate such attacks. Specifically, the vulnerable code attempts to identify and strip out malicious strings from user input. For instance, the code aims to block SSRF attempts by detecting patterns like “file://” in user-submitted data.