Siemba Automates Insecure Direct Object Reference Testing for Production APIs
Siemba introduces automated testing for Insecure Direct Object References (IDOR) in its API Security Testing suite, aiming to rapidly identify vulnerabilities that expose sensitive customer data.
Siemba has enhanced its API Security Testing capabilities with the introduction of automated testing specifically designed to detect Insecure Direct Object References (IDOR). This new feature targets a wide range of APIs, including REST, GraphQL, and SOAP, with the primary goal of identifying vulnerabilities that could lead to the exposure of customer data. The company claims its system can efficiently test up to 200 API endpoints for IDOR flaws in under an hour, a significant reduction in time compared to traditional manual testing methods.
Insecure Direct Object Reference (IDOR) is a critical authorization flaw where a vulnerable API endpoint fails to properly validate that the identifier provided by a user actually belongs to them. This oversight allows an attacker to manipulate a single number or identifier within a request to access or modify data belonging to another user. The Open Web Application Security Project (OWASP) classifies IDOR as Broken Object Level Authorization (BOLA) and ranks it as the top threat in its API Security Top 10 list. The simplicity of the exploit mechanism belies its potential impact, as it is a common cause of data breaches.
"Most API vulnerabilities aren’t exotic," stated Sandhya Prashanth, Chief Security Officer at Siemba. "They are one user’s session reading another user’s data because nobody checked. That is IDOR, and it drives a huge share of real-world breaches. It needs almost no source-level reasoning to find, only the discipline to test every endpoint against it, systematically. That is exactly the kind of work automation should be doing continuously, so security teams can spend their attention on what automation cannot reason about: chained flows and privilege boundaries."
The automated testing process begins with an API definition file, such as an OpenAPI or Swagger specification, a Postman collection, or a collection URL provided by the customer. Siemba then utilizes a set of provided identifiers and handles authenticated sessions to generate and execute test cases across every endpoint that contains an ID-like parameter. Crucially, the system evaluates findings by analyzing the actual API response, rather than relying on signature matching or status codes, ensuring that only confirmed vulnerabilities are reported.
Siemba's platform is designed to test each protocol according to its specific requirements. For REST APIs, individual endpoints are tested across path, query, header, and body parameters. GraphQL schemas are analyzed through introspection to identify potential schema exposure, query depth issues, batching abuse, alias overloading, and field-level authorization flaws. For SOAP operations, parsed from WSDL, the system checks for XML external entity injection, signature wrapping, SOAPAction manipulation, and WS-Security misconfigurations.
While Siemba's automated system maps findings to nine of the ten OWASP API Security Top 10 categories, the tenth category, broken function level authorization, along with complex chained attack paths and nuanced privilege boundary testing, are handled by Siemba's certified penetration testers. This hybrid approach ensures that automated testing covers the breadth of common vulnerabilities, while human experts focus on the more complex and context-dependent security challenges.
The system is built to operate against production environments, offering customers control over test pace through four distinct throttle presets, ranging from a stealth mode suitable for business hours to a turbo mode for dedicated testing windows. These controls, along with independent settings for requests per second, concurrent test cases, and request timeouts, allow for continuous testing without disrupting ongoing operations. Additionally, freeze windows of up to 30 days can be configured to pause testing automatically during critical periods like production freezes or peak trading times.
By enabling continuous testing directly against production APIs, Siemba aims to close the security gap that often exists between point-in-time engagements and the dynamic nature of deployed applications. This approach ensures that APIs are continuously validated in their live environment, where authorization logic and data are real, providing a more accurate and up-to-date security posture.