FlagThis - #apisecurity

API security testing firm APIsec exposed an internal database to the internet without a password, potentially compromising customer data. The database contained customer info and other data generated while monitoring customer APIs for security weaknesses, according to researchers at UpGuard, who discovered the exposed database on March 5th, 2025. UpGuard notified APIsec, and the database was secured the same day. APIsec claims to be used by 80% of the Fortune 100.

The exposed Elasticsearch database contained over three terabytes of data, including configuration information for private scanning instances, results of API scans for customers’ endpoints, and personal information for users collected during scanning. This data provided extensive information about the attack surfaces of APIsec's customers. The database contained indices for executing the APIsec test suites against customer APIs and storing the results, with data spanning from 2018 to 2025.

The APIsec platform helps companies secure their APIs by running tests for common weaknesses. The exposed data included information about which tests were being performed, allowing attackers to potentially look for issues not being tested. The index "fx-accounts" included usernames and credentials for services like AWS, Slack, and GitHub. The index "fx-clusters" contained configuration data for APIsec scanning instances, some of which contained the same AWS access key as the record in "fx-accounts."


References :

• Zack Whittaker: New: API security testing firm APIsec exposed an internal database to the internet without a password. The database contained customer info and other data generated while monitoring customer APIs for security weaknesses, per researchers at UpGuard, which found it.
• techcrunch.com: API testing firm APIsec exposed customer data during security lapse
• www.upguard.com: Watching the Watcher: How a Security Company Leaked Customer Data | UpGuard
• CyberInsider: Security Firm APIsec Exposed 3TB of Sensitive Customer Data

Classification:

• HashTags: #DataBreach #APIsecurity #SecurityLapse
• Company: APIsec
• Target: APIsec customers
• Product: APIsec
• Feature: Database Exposure
• Type: DataBreach
• Severity: Major

Cloudflare is enhancing API security by closing all HTTP ports on api.cloudflare.com, enforcing HTTPS-only connections. This significant move aims to eliminate vulnerabilities associated with cleartext HTTP traffic, where sensitive information like API tokens could be intercepted by malicious actors or network intermediaries. By mandating HTTPS-only connections, Cloudflare is setting a new standard in cybersecurity practices, protecting against potential data leaks and enhancing the overall security posture.

The decision to block unencrypted traffic to API endpoints is a strategic response to the increasing sophistication of cyber threats. Even with automatic redirection from HTTP to HTTPS, a window of vulnerability exists where sensitive data could be transmitted over unencrypted channels. Cloudflare's proactive approach rejects cleartext connections at the transport layer, safeguarding organizations relying on APIs and reducing the risk of cyber threats. This aligns with Cloudflare's efforts to support AI adoption with a security-first approach, ensuring reliable and safe use of AI technologies.


References :

• Cyber Security News: Cloudflare Enhances API Security by Closing HTTP Ports
• gbhackers.com: Cloudflare Shifts to HTTPS-Only for APIs, Closing All HTTP Ports
• The DefendOps Diaries: Cloudflare's HTTPS-Only Initiative: A New Standard in API Security
• www.bleepingcomputer.com: Cloudflare now blocks all unencrypted traffic to its API endpoints

Classification:

• HashTags: #APIsecurity #HTTPS #Cloudflare
• Company: Cloudflare
• Target: API users
• Product: Cloudflare
• Feature: HTTPS Enforcement
• Type: ProductUpdate
• Severity: Informative