Unsafe Consumption of Third-Party APIs

HighAPI SecurityAPI10:2023 – Unsafe Consumption of APIs

An application trusts data, redirects, files, or behavior from an integrated API without applying the same validation and isolation used for direct user input.

Immediate Response

1Disable the affected integration or restrict it to known endpoints and response sizes.
2Quarantine provider data involved in injection, redirect, or replay behavior.
3Rotate integration credentials if the provider or trust channel is compromised.

Short-term Remediation

All playbooks

Long-term Prevention

1Threat-model integrations as untrusted boundaries with explicit failure behavior.
2Isolate parsers and file processing with least privilege and resource limits.
3Continuously monitor provider changes, dependency risk, and outbound destinations.

Attack vectors

A compromised provider returns malicious fields consumed by templates, queries, or commands
Third-party redirects send backend clients to internal or untrusted locations
Oversized, malformed, or compressed responses exhaust application resources
Provider webhooks are accepted without signature, freshness, or replay validation

Indicators of compromise

Unexpected schema fields, content types, redirects, or response sizes from providers
Outbound API calls reaching private, link-local, or newly observed destinations
Application errors or injection signals originating in integration data
Duplicate or stale webhook event identifiers being processed

Tooling

OpenAPIJSON SchemamitmproxyOpenTelemetry