Unrestricted Resource Consumption

Introduction

API keys are crucial for controlling and monitoring access to APIs. However, their misconfiguration can lead to severe security issues. Exposing API keys externally and failing to set proper restrictions are the most common misconfigurations. These misconfigurations can result in potential risks such as unauthorized access to sensitive data, illegitimate requests, resource consumption, and significant costs. In this advisory, we will examine these issues and provide guidance on identifying and preventing them, using Google API key as an example.

In the context of Google products, API keys serve as authentication credentials. They are unique alphanumeric strings that associate your Google billing account with your project and grant access to specific APIs or SDKs (Software Development Kits).

Issue

If a Google API key that has no restrictions is made public in a source code, it can be used by bad actors to gain unauthorized access to Google APIs using your or your application's identity.

Impact

The impact of a compromised Google API key:

• A compromised API key can lead to financial loss through unauthorized consumption of resources on your account.
• Attackers can use your API key to access your online services and cause service disruption.
• Unauthorized API usage can cause your application to malfunction, potentially affecting user experience.
• Recovering from a compromised API key can be time-consuming and resource-intensive, potentially disrupting your workflow.

How to Exploit

1. Find public Google API key(s) in source code. Most commonly, Google maps integrations have the highest possibility of being exposed.
2. Check if the key(s) have permissions or restrictions set to them by using them in API queries (Consult the documentation at https://developers.google.com/maps/documentation for possible API enumerations like routes or directions). If a key is vulnerable, the API should respond with the expected data (i.e.: street directions, addresses, image of location).
3. If interested in possible incurred costs, consult the Google maps platform pricing at https://mapsplatform.google.com/pricing/ to calculate the cost of using the APIs that the key(s) allow(s).

How To Resolve

To prevent this from happening, it is important to properly secure and restrict access to your API keys through your management console. This can include limiting access to the keys to allow certain API usage, certain applications, restricting the budget, regularly monitoring API key usage, and revoking any keys that have been compromised or are no longer needed. By taking these steps, you can help ensure the security of your API keys and prevent unauthorized and unintentional costs from being incurred.

https://developers.google.com/maps/api-security-best-practices