Description.

Improper Asset Management involves discovering unsupported and non-production versions of an API. API providers often release newer versions with updated paths, such as:

    api.target.com/v3
    /api/v2/accounts
    /api/v3/accounts
    /v2/accounts

Versioning can also be managed through headers:

    Accept: version=2.0
    Accept api-version=3

It might also be set within query parameters or request bodies:

    /api/accounts?ver=2
    POST /api/accounts with {"ver":1.0, "user":"hapihacker"}

Earlier API versions, which may no longer receive updates or patches, often expose additional vulnerabilities. For example, if v3 fixed an injection flaw, earlier versions like v1 or v2 could still be vulnerable.
Non-Production API Versions

Non-production versions of an API, such as test or beta environments, may not be secured like production versions. Examples include:

    api.test.target.com
    api.uat.target.com
    beta.api.com
    /api/private
    /api/partner

Discovering these non-production versions can lead to testing for additional weaknesses

Finding Improper Assets Management Vulnerabilities

finding interesting parameters in API documentation and then adding those parameters to requests
Look for parameters involved in user account properties, critical functions, and administrative actions
guess parameters or fuzz them in API requests that accept user input
```
/api/v3/id —> not work
/api/v1/id —> work
```

Mostafa Ashraf

Contact

Description.

Finding Improper Assets Management Vulnerabilities