API06: Unrestricted Access to Sensitive Business Flows

📋 What Is It?

Unrestricted Access to Sensitive Business Flows occurs when APIs expose business workflows that can be excessively used in automated ways, harming the business. Attackers exploit legitimate business features at scale for malicious purposes like scalping, market manipulation, or unfair advantages.

API06 OWASP Rank

Business Logic Abuse

Bots Automated Attacks

⚠️ Common Exploits

Ticket Scalping: Bots buy all concert tickets in seconds
Inventory Hoarding: Automated purchase of limited stock items
Fake Reviews: Automated posting of fake reviews/ratings
Coupon Abuse: Generating/using unlimited discount codes
Flash Sale Gaming: Bots completing purchases faster than humans
Account Creation: Mass fake account creation for spam/fraud

🔴 Attack Flow

1. Attacker identifies checkout API
↓
2. Creates bot to monitor inventory
↓
3. Item goes on sale (limited quantity)
↓
4. Bot purchases 100 units in 5 seconds
↓
5. IMPACT: Legitimate customers can't buy!

❌ Vulnerable Code

// Bad: No bot protection on checkout
@app.route('/api/checkout', methods=['POST'])
@login_required
def checkout():
    items = request.json.get('items')
    
    # No verification if user is human!
    # No limit on purchase frequency!
    order = create_order(current_user, items)
    return jsonify(order)

// Bad: Unlimited review posting
@app.route('/api/products/<id>/review', methods=['POST'])
@login_required
def post_review(id):
    rating = request.json.get('rating')
    comment = request.json.get('comment')
    
    # No verification of actual purchase!
    # No limit on reviews per user!
    review = Review.create(product_id=id, 
                          user_id=current_user.id,
                          rating=rating, 
                          comment=comment)
    return jsonify(review)

// Bad: Unlimited coupon generation
@app.route('/api/referral/code', methods=['GET'])
@login_required
def get_referral_code():
    # User can generate unlimited codes!
    code = generate_referral_code(current_user.id)
    return {'code': code}
                

✅ Secure Code

// Good: Bot detection + rate limiting
@app.route('/api/checkout', methods=['POST'])
@login_required
@limiter.limit("3 per hour")  # Max 3 checkouts/hour
def checkout():
    items = request.json.get('items')
    
    # Verify CAPTCHA for bot detection
    if not verify_captcha(request.json.get('captcha_token')):
        return {'error': 'CAPTCHA failed'}, 400
    
    # Check user behavior patterns
    if is_suspicious_behavior(current_user):
        return {'error': 'Suspicious activity detected'}, 403
    
    # Limit quantity per user
    if total_quantity(items) > MAX_ITEMS_PER_ORDER:
        return {'error': 'Quantity limit exceeded'}, 400
    
    order = create_order(current_user, items)
    return jsonify(order)

// Good: Verified purchase required for review
@app.route('/api/products/<id>/review', methods=['POST'])
@login_required
def post_review(id):
    rating = request.json.get('rating')
    comment = request.json.get('comment')
    
    # Verify user purchased this product
    if not has_purchased(current_user.id, id):
        return {'error': 'Purchase required'}, 403
    
    # Check if user already reviewed
    if Review.exists(user_id=current_user.id, product_id=id):
        return {'error': 'Already reviewed'}, 400
    
    # Apply rate limit on reviews
    if user_reviews_today(current_user.id) >= 5:
        return {'error': 'Daily limit reached'}, 429
    
    review = Review.create(product_id=id,
                          user_id=current_user.id,
                          rating=rating,
                          comment=comment)
    return jsonify(review)

// Good: Limited coupon generation with cooldown
@app.route('/api/referral/code', methods=['GET'])
@login_required
def get_referral_code():
    # Check cooldown period (1 code per 30 days)
    last_generated = get_last_code_time(current_user.id)
    if last_generated and (datetime.now() - last_generated).days < 30:
        return {'error': 'Wait 30 days between codes'}, 429
    
    # Limit total codes per user
    if total_codes_generated(current_user.id) >= 10:
        return {'error': 'Code limit reached'}, 403
    
    code = generate_referral_code(current_user.id)
    return {'code': code}
                

✓ Prevention Checklist

Implement CAPTCHA for sensitive business flows
Apply rate limiting per user and IP
Monitor and detect automated behavior patterns
Require verified purchase for reviews
Limit quantity per order/user
Implement cooldown periods for actions
Use device fingerprinting
Implement progressive delays for suspicious behavior
Add randomized timing to prevent automation
Monitor for velocity anomalies
Implement account aging requirements
Use behavioral analysis (ML/AI)

🔍 Detection & Tools

Bot Detection Tools:

reCAPTCHA hCaptcha PerimeterX DataDome Cloudflare Bot Management Akamai Bot Manager

Rate Limiting Tools:

Redis Flask-Limiter Express Rate Limit Kong AWS WAF

How to Test:

Automate business flow requests at high speed
Test purchase limits per user/session
Try posting multiple reviews without purchase
Test referral code generation limits
Monitor for CAPTCHA requirements

🌍 Real-World Breaches

PlayStation 5 Launch (2020): Bots bought entire stock in minutes, resold at 2x price
Supreme Clothing Drops: Automated bots dominate limited releases
Concert Tickets: Ticket scalpers use bots to buy thousands of tickets
Sneaker Releases: Nike, Adidas face constant bot attacks on limited editions
COVID Vaccine Appointments: Bots booked appointments, preventing legitimate access

📌 Quick Tips

DO NOT allow unlimited sensitive actions
DO NOT skip bot detection on business flows
DO implement CAPTCHA on checkout/purchase
DO rate limit per user and IP
DO monitor for automation patterns
DO require purchase verification for reviews
DO implement progressive delays

📜 Compliance

Related Standards:

PCI-DSS Requirement 6.5.10
NIST 800-53 SC-5
ISO 27001 A.12.2.1
SOC 2 CC7.2

🎯 Unrestricted Access to Sensitive Business Flows