Schema is empty

Description

The schema is empty. This means that your API accepts any JSON values.

For more details, see the OpenAPI Specification.

Example

The following is an example of how this type of risk could look in your API definition. The method POST accepts a JSON payload in the body but does not specify the schema of the payload:

1post:
2  description: Creates a new pet in the store
3  operationId: addPet
4  parameters:
5    - name: pet
6      in: body
7      description: pet to add to the system
8      required: true
9      schema: {}
10

Possible exploit scenario

If you do not clearly define the schema and you leave properties of a JSON payload empty, you effectively allow attackers to pass in any data. This means that you are opening your backend to various attacks, such as SQL injection.

This also lets attackers to try various unexpected inputs. Unexpected inputs may cause the backend server to crash or behave in an unexpected way. This in turn may cause the server to potentially leak stack trace that can be used for further attacks, or even data.

If no restrictions to the set of properties in the JSON payload are enforced, the API might also accept more fields than expected. The received payloads could be blindly transformed into an object and stored, overwriting sensitive internal data. For more details, see API6:2019 — Mass assignment in OWASP API Security Top 10.

Remediation

Make sure you define schemas for all JSON payloads. Here, a specific JSON object NewPet is defined in #/definitions and referenced as the schema for the API method:

1post:
2  description: Creates a new pet in the store
3  operationId: addPet
4  parameters:
5    name: pet
6    in: body
7    description: pet to add to the system
8    required: true
9    schema:
10      $ref: "#/definitions/NewPet"
11# ...
12NewPet:
13  type: object
14  required:
15    - name
16  properties:
17    name:
18      type: string
19      description: Pet name
20    tag:
21      type: string
22      description: Pet tag
23

Copyright 42Crunch 2021