Security Misconfiguration

#web #APIs #attacks

Web APIs are susceptible to the same security misconfigurations that can compromise traditional web applications. One typical example is a web API endpoint that accepts user-controlled input and incorporates it into SQL queries without proper validation, thereby allowing Injection attacks.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The endpoint we will be practicing against is vulnerable to CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').

Scenario

The admin of Inlanefreight E-Commerce Marketplace has provided us with the credentials htbpentester12@pentestercompany.com:HTBPentester12, wanting us to assess what API vulnerabilities the user can exploit with their assigned roles.

After obtaining a JWT as a supplier from the /api/v1/authentication/suppliers/sign-in endpoint and authenticating with it, we observe that the /api/v1/roles/current-user endpoint reveals that we have the Products_GetProductsTotalCountByNameSubstring role:

image-88.png

The only endpoint related to that role name is /api/v1/products/{Name}/count, which belongs to the Products group. When exploring this endpoint, we find that it returns the total count of products containing a user-provided substring in their name:

image-89.png

For example, if we use laptop as the Name substring parameter, we find that there are 18 matching products in total:

image-90.png

However, if we try using laptop' (with a trailing apostrophe) as input, we observe that the endpoint returns an error message, indicating a potential vulnerability to SQL injection attacks:

image-91.png

Let us attempt to retrieve the count of all records in the Products table using the payload laptop' OR 1=1 --; we will discover that there are 720 products in the table:

image-92.png

HTTP Headers

APIs can also suffer from security misconfigurations if they do not use proper HTTP Security Response Headers. For example, suppose an API does not set a secure Access-Control-Allow-Origin as part of its CORS (Cross-Origin Resource Sharing) policy. In that case, it can be exposed to security risks, most notably, Cross-Site Request Forgery (CSRF).

Prevention

To mitigate the Security Misconfiguration vulnerability, the /api/v1/products/{Name}/count endpoint should utilize parameterized queries or an Object Relational Mapper (ORM) to safely insert user-controlled values into SQL queries. If that is not a choice, it must validate user-controlled input before concatenating it into the SQL query, which is never infallible.

Furthermore, if the web API is using HTTP headers insecurely or omits security-related ones, it should implement secure headers to prevent various security vulnerabilities from occurring. Projects like OWASP Secure Headers provide guidance on HTTP security headers and how to avoid security vulnerabilities associated with improper header configurations.

Exercise

TARGET: 154.57.164.77:36521

Authenticate to target with username "htbpentester13@hackthebox.com" and password "HTBPentester13"

Challenge 1

Exploit another Security Misconfiguration and provide the total count of records within the target table.

HINT: Focus on the GET /api/v1/suppliers/{Name}/count endpoint.

Remember the API testing UI is under the /swagger endpoint. Lets authenticate as a costumer with the given credentials:
image-93.png
This is the JWT we get:

eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9uYW1laWRlbnRpZmllciI6Imh0YnBlbnRlc3RlcjEzQGhhY2t0aGVib3guY29tIiwiaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2NsYWltcy9yb2xlIjoiU3VwcGxpZXJzX0dldFRvdGFsQ291bnRCeVN1cHBsaWVyTmFtZVN1YnN0cmluZyIsImV4cCI6MTc5MjM1NTQyNiwiaXNzIjoiaHR0cDovL2FwaS5pbmxhbmVmcmVpZ2h0Lmh0YiIsImF1ZCI6Imh0dHA6Ly9hcGkuaW5sYW5lZnJlaWdodC5odGIifQ.P0HLqVlGPrps0BgXVYrMoKxCNEpxLR11i-oD-E72R351AOPLApTQeEPjwsPXN7inVGpYnokhBFCij_wMGXgG8Q

Since we are told we need to focus on the /api/v1/suppliers/{Name}/count endpoint, lets check it out and provide a random string as a name:
image-94.png
Ok, now what happens if we test SQL injection in the Name field, lets try appending a single ' to escape the query:
image-95.png

Lets try a more useful SQL payload to count the number of records within the target table: laptop' OR 1=1 --
image-96.png

flag: 151

Challenge 2

Submit the header and its value that expose another Security Misconfiguration in the API.

The lesson text literally spells out the next vuln right before the exercise: CORS misconfiguration via the Access-Control-Allow-Origin header

First send a request with an Origin header set to an arbitrary/attacker domain (i.e. https://evil.com) and see what the API reflects back:

┌──(macc㉿kaliLab)-[~/htb/api_attacks]
└─$ curl -s -i \
  -H "Origin: https://evil.com" \
  -H "Authorization: Bearer eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9uYW1laWRlbnRpZmllciI6Imh0YnBlbnRlc3RlcjEzQGhhY2t0aGVib3guY29tIiwiaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2NsYWltcy9yb2xlIjoiU3VwcGxpZXJzX0dldFRvdGFsQ291bnRCeVN1cHBsaWVyTmFtZVN1YnN0cmluZyIsImV4cCI6MTc5MjM1NTQyNiwiaXNzIjoiaHR0cDovL2FwaS5pbmxhbmVmcmVpZ2h0Lmh0YiIsImF1ZCI6Imh0dHA6Ly9hcGkuaW5sYW5lZnJlaWdodC5odGIifQ.P0HLqVlGPrps0BgXVYrMoKxCNEpxLR11i-oD-E72R351AOPLApTQeEPjwsPXN7inVGpYnokhBFCij_wMGXgG8Q" \
  "http://154.57.164.77:36521/api/v1/suppliers/laptop/count"
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Date: Sun, 18 Oct 2026 20:29:59 GMT
Server: Kestrel
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked

{"suppliersCount":0}

Look specifically for these response headers:

flag: Access-Control-Allow-Origin: *