OWASP API #6 — Unrestricted Access to Sensitive Business Flows: When Legitimate APIs Are Abused

The coupon redemption API works exactly as intended.

But what if an attacker sends hundreds of requests within seconds and redeems the same coupon multiple times before the server validates it?

Or repeatedly requests OTPs, books limited tickets using bots, or creates thousands of fake accounts to claim referral rewards?

The API isn't broken — it's simply missing controls to prevent abuse of legitimate business processes.

This is OWASP API #6 — Unrestricted Access to Sensitive Business Flows.

What is Unrestricted Access to Sensitive Business Flows?

This vulnerability occurs when an API allows attackers to abuse legitimate business functionality because it lacks sufficient protections such as rate limiting, workflow validation, or abuse detection.

Unlike traditional vulnerabilities, the attacker doesn't exploit a coding bug.

Instead, they exploit how the business process works.

Examples include:

• Password Reset APIs
• OTP Generation APIs
• Coupon Redemption
• Ticket Booking
• Money Transfer
• Referral Reward Systems
• Gift Card Redemption
• Free Trial Registration

Real-World Breach: Instagram Password Reset

Instagram implemented rate limiting on password reset requests based on the client's IP address.

Researchers discovered they could rotate through thousands of different IP addresses while continuously guessing password reset codes.

Because the rate limit was tied only to the IP address instead of the user account, attackers were able to bypass the intended protection.

This significantly increased the likelihood of successful account takeover attempts.

How Attackers Exploit It

Attackers automate legitimate API requests rather than exploiting software vulnerabilities.

Typical attack flow:

• Identify sensitive business APIs.
• Automate repeated API requests.
• Rotate IP addresses to bypass rate limits.
• Trigger the same business action thousands of times.
• Abuse business logic for financial or operational gain.

How Pentesters Should Test

• Identify APIs handling payments, coupons, bookings, OTPs, referrals, and password resets.
• Test whether rate limits exist per user, account, device, or IP.
• Send repeated requests using Burp Intruder or automation tools.
• Test race conditions by sending multiple simultaneous requests.
• Verify whether duplicate transactions are possible.
• Check if workflow steps can be skipped or bypassed.
• Test whether changing IP addresses bypasses restrictions.
• Verify whether server-side validation exists for every business step.

Prevention & Best Practices

• Apply rate limiting based on users, accounts, and business operations — not only IP addresses.
• Validate every business workflow on the server.
• Prevent duplicate requests using transaction IDs or idempotency keys.
• Implement CAPTCHA where appropriate.
• Detect bot activity and abnormal request patterns.
• Monitor high-frequency business transactions.
• Log suspicious workflow abuse attempts.
• Perform regular business logic security testing.

This is Part 6 of my OWASP API Security Top 10 series.

In the next blog, we'll explore OWASP API #7 — Server-Side Request Forgery (SSRF) and learn how attackers force servers to make unintended internal and external requests.

Until then, feel free to connect with me on LinkedIn:

www.linkedin.com/in/narmadha-natarajan07

Thank you for reading! 🚀