A U.S.-based online marketplace already had API discovery, AI-based red-teaming, bot protection, and runtime defense in place. Yet its existing AI red-teamer tested APIs individually and could not replicate the multi-step workflows an attacker would use. In a two-week proof of concept, AppSentinels uncovered a blind SSRF along with multiple other critical API and application layer vulnerabilities.
Key Challenges
- Blind SSRF: A vulnerable nested image URL was reachable only after several steps in a workflow and produced no visible response or timing signal.
- Workflow-level vulnerabilities: Existing testing could not chain API calls to uncover flaws that emerged only through specific sequences.
- BOLA vulnerabilities: Attackers could potentially substitute another user’s identifier to access their objects.
- Broken authentication: An API accessible with a partner key returned profile information, including personal data, without a user token.
- Additional vulnerabilities: NoSQL injection and reflected XSS were also identified.
The AppSentinels Solution
- API Discovery: Mapped the API environment, identifying previously unknown and unauthenticated APIs as well as APIs carrying sensitive data.
- Automated Workflow-Aware Testing: Generated tests from observed traffic and automatically chained API calls to identify unintended application behavior.
- End-to-End Exploit Validation: Recreated the vulnerable workflow, validated the blind SSRF through an out-of-band callback, and reproduced the exploit on demand.
- Continuous Testing: Enabled automated testing to be re-run as the API environment evolved, without requiring manual test scripts.
Business Impact
- Uncovered critical vulnerabilities missed by existing security tools.
- Reduced manual effort with 2,577 automated workflow tests.
- Improved API visibility with 2,400 APIs discovered in under 24 hours.
- Accelerated security validation with a two-week POC that moved into commercial discussion.
