Issue 279: Tax records leak, Hacked service robots, Frostbyte at US stores, Layer 7 API attacks
Brief
This week, we share API security incidents from across different industries, highlighting the common vulnerabilities that continue to surface, from government web portals and security platforms to industrial equipment, home devices, and even service robots at your local restaurant.
Vulnerability: Tax Records Leak with API IDOR Flaw
Researcher Aseem Shrey disclosed an Insecure Direct Object Reference (IDOR) vulnerability in India’s Goods and Services Tax portal that exposed sensitive taxpayer records. He noticed that the web portal retrieves tax payment data through an API request, and that the request includes a receipt ID.
This often prompts a hacker to check if by changing a resource ID value can they access other users’ information. The fact that BOLA/IDOR is at the top of the OWASP API Top 10 vulnerability list suggests the answer is often a resounding yes!