API9:2019 Improper Assets Management

📋 What Is It?

Improper Assets Management is not knowing what you are running. APIs multiply faster than the documentation that describes them: old versions stay deployed "for one legacy client", staging and beta hosts sit on the public internet, an acquired team's service is never inventoried, and the specification drifts away from what the code actually serves. Every endpoint you cannot list is an endpoint nobody is patching, monitoring, or reviewing.

The attacker's advantage here is asymmetric: they enumerate hosts and paths automatically, while the defender relies on memory and stale wiki pages. The oldest version is usually the weakest - and it reaches the same production data.

API9 OWASP Rank 2019

Shadow & Zombie APIs

Same Production Data

⚠️ Common Exploits

Zombie Versions: /api/v1 still live, missing every fix added in /v2
Shadow APIs: endpoints in production that no inventory or spec records
Exposed Non-Production: staging., dev., uat. hosts reachable, often with real data
Deprecated-But-Deployed: announced end-of-life, never actually switched off
Undocumented Debug Routes: internal tooling left in the released build
Spec Drift: OpenAPI describes fewer routes and fields than the service serves
Third-Party Sprawl: forgotten integrations holding valid credentials

🔴 Attack Flow

1. Enumerate subdomains and hosts (certificate logs, DNS, search engines)
↓
2. Brute-force version prefixes and path patterns: v1, v2, beta, internal
↓
3. Compare behaviour between versions - which lacks the newest checks?
↓
4. Attack the weakest surviving version or environment
↓
5. IMPACT: Production data through a door nobody remembered was open!

❌ Vulnerable Code

# Bad: every version ever shipped is still mounted
app.register_blueprint(v1, url_prefix='/api/v1')   ← 2019 code, no rate limit, no BOLA checks
app.register_blueprint(v2, url_prefix='/api/v2')
app.register_blueprint(beta, url_prefix='/api/beta') ← undocumented, unmonitored

# Bad: non-production exposed to the world, with a copy of live data
# staging.example.com  → public DNS, no auth gateway, prod database snapshot

// Bad: docs and reality diverge
// openapi.yaml lists 12 paths; the service actually answers on 31

// Bad: introspection and docs open in production
app.use('/graphql', graphqlHTTP({ schema, graphiql: true }));   ← full schema published
                

✅ Secure Code

# Good: one supported version, with a dated sunset for the previous one
app.register_blueprint(v2, url_prefix='/api/v2')

@app.route('/api/v1/<path:_>')
def v1_gone(_):
    return {'error': 'API v1 was retired on 2025-06-30. Use /api/v2.'}, 410

# Good: the spec is generated from the code and enforced in CI
# CI: diff live routes against openapi.yaml → fail the build on any drift
assert discovered_routes() == spec_routes()

// Good: environments separated and gated
// staging: private DNS + SSO/VPN + synthetic data only, never a prod snapshot

// Good: no schema publication in production
app.use('/graphql', graphqlHTTP({
    schema,
    graphiql: process.env.NODE_ENV !== 'production',
    validationRules: [NoSchemaIntrospectionCustomRule],
}));

# Good: every route registers itself in the inventory with an owner
register_asset(path='/api/v2/orders', owner='payments-team', data_class='PII')
                

✓ Prevention Checklist

Maintain a live inventory of every API, version, host, and environment
Give each API an owner, a data classification, and a lifecycle state
Generate the specification from code and fail CI on drift
Publish deprecation and sunset dates - then actually switch versions off
Return 410 Gone for retired versions instead of leaving them live
Keep non-production environments private and free of real data
Run continuous external discovery (subdomains, certificate transparency, scans)
Route all traffic through a gateway so nothing is unmonitored
Disable docs, introspection, and debug routes in production
Review third-party integrations and revoke unused credentials

🔍 Detection & Tools

Discovery:

amass / subfinder crt.sh httpx kiterunner Shodan

Inventory & Governance:

API gateway catalogue OpenAPI diff Service catalogues CMDB

How to Test:

Enumerate subdomains and probe each for API paths
Swap the version prefix on known routes: v1, v0, beta, internal
Compare responses between versions for missing controls
Diff live routes against the published specification
Check whether staging hosts answer from the internet and with what data

🌍 Real-World

These are documented incident classes - recurring patterns rather than single CVEs.

Breach through an old version: a retired-in-name-only /v1 lacking the authorization fixes added in /v2, still connected to production data.
Public staging environments: a "test" host with a copy of the production database and no authentication in front of it.
Shadow APIs after acquisitions or migrations: services nobody owns, unpatched for years, discovered first by an attacker's scanner.
Undocumented internal endpoints: debug and admin routes that never appeared in the spec and were therefore never reviewed.
Forgotten integrations: long-lived credentials issued to a partner integration that was switched off years ago but never revoked.

📌 Quick Tips

DO NOT leave old versions running "just in case"
DO NOT put production data in staging
DO inventory every API with an owner and a sunset date
DO generate the spec from code and gate CI on drift
DO scan your own perimeter the way an attacker does

📜 Compliance

Related Standards:

OWASP API Security Top 10 2019 - API9
Renamed to API9:2023 Improper Inventory Management
CWE-1059 Insufficient Documentation
CWE-1104 Use of Unmaintained Third Party Components
CIS Control 1 & 2 - Inventory of Enterprise Assets and Software

🗂️ Improper Assets ManagementAPI 2019