Improper Assets Management

Question 1

What is improper assets management?

Answer 1

It’s a vulnerability that happens when unsupported or non-production versions of an API are exposed. This versions can be susceptible to other vulnerabilities.

Question 2

Explain what is a non-production version of an API

Answer 2

A non-production version includes any version that is not meant for end-user consumption, like test versions.

Question 3

Explain what is a unsupported version.

Answer 3

These include outdated versions, like a version 1.0 of an API that’s currently in version 2.0.

Question 4

Where can you check for an API version?

Answer 4

Usually the API version will be indicated in the URL, headers, query parameter or request body.

Question 5

API:2019 Improper Assets Management is most like which other common vulnerability?

Answer 5

OWASP AO6:2021 Vulnerable and Outdated Components

Question 6

Which of the following is most likely a non-production version of an API?
a) api.target.com.v1
b) staging.target.com
c) target.com/v2/users
d) target.com/api/public

Answer 6

Letter b. It involves a version that’s not meant for end-user consumption.