Salt Security released new API threat research from Salt Labs that highlights a GraphQL API authorization vulnerability in a B2B financial technology (FinTech) platform. The findings, which were identified by researching the mobile applications and SaaS platform of this FinTech provider, call attention to authorization-level flaws that can arise with nested queries in GraphQL, an open-source query language used to build APIs.

Salt Labs found that the failure to implement authorization checks correctly meant the researchers could submit unauthorized transactions against any customer account and harvest any customer’s sensitive data.

“GraphQL provides some advantages in query options compared to REST APIs. With this flexibility, however, comes risk, since a single API call can include multiple separate queries,” said Roey Eliyahu, co-founder and CEO, Salt Security. “As GraphQL gains traction, our goal is to provide users with the intelligence, capabilities, and support to develop more secure API environments. Salt Labs is leading the charge to bring awareness to GraphQL-specific risks that have the potential for business disruption and unauthorized data disclosure.”

According to the Salt Security State of API Security Report, Q3 2021, 62% of organizations have no or just a basic API security strategy in place. This lack of protection is particularly worrisome as cyberattacks targeting APIs are on the rise alongside the adoption of relatively new technologies like GraphQL, which has doubled from 2020 to 2021, according to industry* sources. In the case of the GraphQL authorization flaw discovered by Salt Labs, attackers can manipulate API calls to exfiltrate sensitive user data and initiate unauthorized transactions. This financial technology platform also introduced an additional security gap, in which some API calls accessed an API endpoint that required no authentication. Salt Labs researchers could enter any transaction identifier and pull back data records of previous financial transactions. Across these two significant vulnerabilities, any user could extract sensitive personally identifiable information (PII) of any customer, and transfer funds out of customers’ accounts without their knowledge.

 “Without dedicated API security tooling in place, organizations with API-based applications and platforms are opening the door to serious risks. The prevailing assumption in the industry around GraphQL is that these APIs are uncommon, obscure targets of attack and therefore safer,” said Michael Isbitski, Technical Evangelist, Salt Security. “This assumption is wrong. Security through obscurity has always been a poor strategy, and the complexity of GraphQL APIs makes securing them more challenging. The Salt Labs research demonstrates that missteps in GraphQL APIs are leading to vulnerabilities and new attack vectors that leave organizations at risk.”

Flexibility and complexity increase the difficulty of securing GraphQL APIs. Machine assistance is essential to analyzing the large amounts of API telemetry data necessary to identify access control flaws and behavioral anomalies. API gateways and web application firewalls (WAFs) cannot protect against these attack vectors, and developers cannot identify all issues without the APIs being exercised in runtime.