Title

The amount of data returned by the API must be restricted. (Cat I impact)

Discussion

Restrict exposing excessively large sets of data that could be used to discover vulnerabilities or extract sensitive information. This will protect sensitive information and prevent performance bottlenecks caused by returning large, unnecessary datasets.

Check Content

Verify the amount of data returned by the API is restricted. Check API endpoints: Review the various API endpoints and the data they return. Look for endpoints that might expose excessively large datasets or sensitive information (e.g., entire user lists, full transaction histories). If the API exposes unusually large volumes of data in a single response (entire datasets, unrestricted record sets, or bulk exports without proper limits or pagination) this is a finding.

Fix Text

Ensure API responses are small and contain only the data necessary for the client's request. To ensure that the amount of data returned by an API is appropriately restricted, implement and test measures like pagination, field filtering, query parameters, server-side limits, and proper access control.

Additional Identifiers

Rule ID: SV-274709r1143744_rule

Vulnerability ID: V-274709

Group Title: SRG-APP-000439

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.