OAuth2 password flow in security definitions for OpenAPI 2.0 file misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_OPENAPI_11
Category - Subcategory	Public Exposure - APIs
Provider	OTHER
Severity	HIGH
Framework	OpenAPI

Impact

This rule is specifically geared towards ensuring the security of OpenAPI documents for APIs, specifically for those using OAuth2 authentication in version 2.0 files. The rule checks for the presence of 'password' flow. The usage of 'password' flow allows direct usage of usernames and passwords to obtain access tokens, circumventing stronger methods of authentication. This leaves user credentials, and by extension your API, more susceptible to cyber threats, hence it is not recommended. The rule aims to flag this as an issue in order to maintain the best security practices.

How to Fix

To fix this issue, define a securityDefinitions section in your OpenAPI specification version 2.0 file which contains scopes for OAuth according to what is provided at API level on global security section.

The above code is secure because it defines the securityDefinitions section properly. It includes both API Key and OAuth2 security schemes and references them in the security section at the root level of the API specification. Plus, OAuth2 utilizing 'implicit' flow involves scopes, and the scopes are defined at the global level, thus enforcing security at the API level. [source,go]

{ "swagger": "2.0", "info": { "version": "1.0.0", "title": "Swagger Sample API" }, "securityDefinitions": { "api_key": { "type": "apiKey", "name": "api_key", "in": "header" }, "petstore_auth": { "type": "oauth2", "authorizationUrl": "http://petstore.swagger.io/api/oauth/dialog", "flow": "implicit", "scopes": { "write:pets": "modify pets in your account", "read:pets": "read your pets" } } }, "security": [ { "api_key": [] }, { "petstore_auth": [ "write:pets", "read:pets" ] } ] }