API09:2023 — Improper Inventory Management

Intro

APIs evolve fast. Old versions get replaced, test environments pop up, and beta features sneak into production. But here’s the problem: many organizations forget to retire or secure outdated APIs.

This is where Improper Inventory Management comes in. It’s when older or non-production APIs remain exposed, often with weaker security. Attackers love this because old endpoints = old vulnerabilities.

Example:

A pentester is hired to test an e-commerce API.
The docs say the latest version is /v3/. But out of curiosity, they try:

GET /api/v1/users/123

To their surprise, /v1/ is still working. Worse: it returns full user details (email, address, phone, hashed password) that /v3/ had stopped exposing.

No exploit needed — just checking old endpoints. Developers forgot to shut it down, and now sensitive data leaks are possible.

How Attackers Exploit This

Attackers don’t need zero-days — they just try:

• Old versions: /api/v1/ or /api/v2/ might still respond, even if /api/v3/ is official.
• Non-production APIs:
• api.test.example.com
• beta.api.example.com
• /api/private or /api/demo
• Fuzzing & brute force: Simply guessing endpoints like /uat/ or /staging/.
• Using outdated docs: Public changelogs, GitHub commits, or archived docs can expose forgotten paths.

Why It’s Dangerous

Improper inventory management often leads to:

• Sensitive data exposure
• Exploitation of unpatched vulnerabilities in old APIs
• Bypass of modern authentication & authorization
• Full system compromise

Think of it this way: you patched the front door, but forgot to lock the back one.

Preventive Measures (OWASP)

To avoid this trap:

1. Maintain an API inventory: track all hosts, versions, and environments.
2. Decommission old versions: don’t leave /v1 hanging around.
3. Harden non-production APIs: staging & test should never be public-facing.
4. Automate documentation: use OpenAPI/Swagger with CI/CD pipelines.
5. Apply same security controls everywhere: TLS, auth, logging, and rate limiting.
6. Audit regularly: use scanners (ZAP, Burp, Nuclei, etc.) to detect forgotten endpoints.

Summary

Improper Inventory Management isn’t flashy. But it’s one of the easiest mistakes to exploit. Old APIs, forgotten test environments, and outdated documentation give attackers shortcuts into your system.

⚠️ Disclaimer

This blog is for educational purposes only. The examples shown are meant to help developers and security professionals recognize common mistakes before attackers exploit them.

If you want to deepen your knowledge, check out APIsec University — an amazing resource to learn API security hands-on.