API Unsafe Third-Party Consumption (OWASP API10)

Purpose

Test whether the target API consumes data from external services (webhooks, payment callbacks, identity providers, enrichment APIs) without properly validating the input, enabling data poisoning, injection, or trust-boundary failures.

Preconditions

• The target accepts data from a third-party source (webhook, callback, API response, OAuth provider)
• You can influence the data the third party sends (or simulate it)

Distinction from SSRF

• SSRF (API7): The TARGET sends a request to an unintended destination
• Unsafe consumption (API10): The TARGET trusts and mishandles data returned/provided by another API

Attack Surface Signals

• Webhook endpoints (Stripe, PayPal, GitHub, Slack, etc.)
• Payment processor callbacks
• Identity provider (IdP) data ingestion (OAuth userinfo, SAML assertions, SSO)
• Third-party enrichment APIs (email verification, credit checks, address validation)
• External feed/RSS import
• Remote image/document/file ingestion
• Shipping/tracking API responses
• Third-party authentication flows (sign in with Google/GitHub)
• External data imports (CSV, JSON, XML from a URL)

Methodology

Step 1: Identify Third-Party Data Ingestion Points

Map where the target accepts external data:

• What fields from the third-party response are consumed?
• Are they stored, displayed, or used in logic decisions?
• Is there signature/HMAC validation?

Step 2: Test Webhook Payload Injection

# If you control the webhook source (e.g., you registered a webhook):
# Send a webhook with malicious payload in fields the target processes