ALBeast: a simple misconfiguration to a complete authentication bypass

The ALBeast vulnerability represents a critical security flaw in AWS Application Load Balancer (ALB) authentication implementation that could lead to complete authentication bypass. This vulnerability, affecting over 15,000 applications, stems from improper validation of AWS-specific header claims and misconfigured security groups, allowing attackers to forge authentication tokens and impersonate legitimate users. The issue highlights the importance of proper JWT validation and security group configuration in AWS ALB implementations.

Decoding ownCloud’s Vulnerabilities: The Hidden Flaws of API Trust

An in-depth analysis of three critical vulnerabilities discovered in ownCloud's API infrastructure, exposing risks in authentication, OAuth implementation, and file access controls. These security flaws highlight the importance of treating third-party APIs with enhanced scrutiny and implementing proper validation measures. Learn how these vulnerabilities were patched and what steps organizations should take to protect their systems.

JWTs Under the Microscope: How Attackers Exploit Authentication and Authorization Weaknesses

JSON Web Tokens (JWTs) offer stateless authentication in modern web applications, but improper implementation can expose critical vulnerabilities. This analysis explores attack vectors across JWT components, revealing how small oversights can lead to significant security breaches like privilege escalation and unauthorized access.

Another Milestone! Traceable Wins the 2023 Cybersecurity Breakthrough Award

Explore Traceable's award-winning API security, recognized by the 2023 CyberSecurity Breakthrough Award, and how ZTAA provides future-proof protection.

Recent Posts

ALBeast: a simple misconfiguration to a complete authentication bypass

JWTs Under the Microscope: How Attackers Exploit Authentication and Authorization Weaknesses

Decoding ownCloud’s Vulnerabilities: The Hidden Flaws of API Trust

Help, I'm Being Attacked: Why WAFs & Gateways Won't Stop the Next API Attack

Let’s Face It - Criminals are bypassing selfie verification in Know Your Customer processes

API Security: The Risk Threatening Australian Businesses

API Security

The Authorization Maze

This article delves deep into the complexities of authorization in API security, exploring why implementing robust access controls is far more challenging than many engineers realize. Through real-world examples from companies like Airbnb and Uber, the author breaks down different types of authorization vulnerabilities (BOLA, BOPLA, BFLA) and explains the nuanced challenges of creating dynamic, context-aware access policies.

Help, I'm Being Attacked: Why WAFs & Gateways Won't Stop the Next API Attack

Many organizations mistakenly believe that Web Application Firewalls (WAFs) or API gateways provide sufficient protection against API attacks. While these tools offer useful traffic management and basic security features, they fall short when it comes to defending against more sophisticated API threats. WAFs are designed for web applications, not the complex logic and workflows of APIs, leaving them vulnerable to business logic and shadow API attacks. Similarly, API gateways, while helpful for managing API traffic and authentication, often miss critical vulnerabilities. Understanding the limitations of WAFs and gateways is the first step in strengthening your API security strategy.

API Security: The Risk Threatening Australian Businesses

Explore API security ownership in modern Australian enterprises, key stakeholders, and how regulations like APRA and SOCI shape security practices and governance.

Why "Check-the-Box” Solutions Are Insufficient for API Security

Why “Check-the-Box” Solutions Are Insufficient for API Security

Organizing API Security Around the NIST Framework

Revolutionize your API security strategy with NIST Cybersecurity Framework 2.0. Enhance protection, detection, and incident response.

Traceable ASPEN

ALBeast: a simple misconfiguration to a complete authentication bypass

The ALBeast vulnerability represents a critical security flaw in AWS Application Load Balancer (ALB) authentication implementation that could lead to complete authentication bypass. This vulnerability, affecting over 15,000 applications, stems from improper validation of AWS-specific header claims and misconfigured security groups, allowing attackers to forge authentication tokens and impersonate legitimate users. The issue highlights the importance of proper JWT validation and security group configuration in AWS ALB implementations.

Angular-ing for AuthZ, Problematic anti-patterns in Single Sign On Systems

A critical SSO vulnerability in a Fortune 500 app risks millions of records. Learn about SSO security risks, fixes, and protecting APIs from similar attacks.

Traceable ASPEN: Leading the Charge in API Security Research

Discover Traceable ASPEN, a dedicated team revolutionizing API security through research on API sprawl, vulnerabilities, and threat intelligence.

ALBeast: a simple misconfiguration to a complete authentication bypass

The ALBeast vulnerability represents a critical security flaw in AWS Application Load Balancer (ALB) authentication implementation that could lead to complete authentication bypass. This vulnerability, affecting over 15,000 applications, stems from improper validation of AWS-specific header claims and misconfigured security groups, allowing attackers to forge authentication tokens and impersonate legitimate users. The issue highlights the importance of proper JWT validation and security group configuration in AWS ALB implementations.

JWTs Under the Microscope: How Attackers Exploit Authentication and Authorization Weaknesses

JSON Web Tokens (JWTs) offer stateless authentication in modern web applications, but improper implementation can expose critical vulnerabilities. This analysis explores attack vectors across JWT components, revealing how small oversights can lead to significant security breaches like privilege escalation and unauthorized access.

Decoding ownCloud’s Vulnerabilities: The Hidden Flaws of API Trust

An in-depth analysis of three critical vulnerabilities discovered in ownCloud's API infrastructure, exposing risks in authentication, OAuth implementation, and file access controls. These security flaws highlight the importance of treating third-party APIs with enhanced scrutiny and implementing proper validation measures. Learn how these vulnerabilities were patched and what steps organizations should take to protect their systems.

Product Updates

December Software Release

December was an extremely busy month for Traceable as we worked with customers to protect their environments from the Log4Shell vulnerability.

Traceable Defense AI M8 Released

Easier deployment process, extended agent support, extended API Intelligence, easier to find problems, protection additions, improved UX around threat hunting, ability to isolate per environment

Manage your external attack surface with new Traceable Sonar

Traceable Sonar efficiently identifies and catalogs these assets, granting security teams a panoramic view of their external attack surface. But it doesn't stop at discovery. Sonar delves deep into these assets, pinpointing vulnerabilities an attacker might exploit. By mirroring the probing techniques attackers use, Traceable Sonar equips organizations with critical insights into potential security loopholes.

Traceable API Security Platform Updates - July 2023

The Traceable AI team has been busy adding new capabilities and enhancing existing ones to better meet your API Security needs. Here is a sampling of some of the additions in July 2023.

Introducing Traceable's Digital Fraud Prevention: A New Frontier in API Security

At Traceable, we continually push the boundaries of innovation. Today, we're thrilled to announce the latest development in our mission to provide robust security to businesses worldwide - the launch of our Digital Fraud Prevention capabilities.

OWASP API Security Top 10 List 2023 Refresh