Average request payload size elevated

firetail:average-request-payload-size-elevated

Type:

Detection

Rule Severity:

Info

The average request payload size during a given period was >= the mean average + one standard deviation of the preceding period.

The average request payload size of the API has significantly increased, surpassing the mean average plus one standard deviation from the preceding period. This means that requests sent to the API are now containing more data than usual. This elevation in payload size could be caused by changes in the client-side applications, updates in API features, or possibly an attack where malicious or large data sets are being submitted in an attempt to overwhelm the system or extract more resources.

Remediation

Investigate what has caused the request payloads sent to this API to increase significantly in size.

Example Attack Scenario

An attacker could exploit the increased request payload size by sending a large, malicious payload designed to overwhelm the API or its backend systems. For example, the attacker may send a massive payload to bypass rate-limiting and data validation mechanisms or to exploit potential vulnerabilities such as buffer overflows or memory exhaustion.

  • Denial of Service (DoS): An attacker could send requests with exceptionally large payloads to exhaust server resources, leading to slower response times, timeouts, or even server crashes.
  • SQL Injection or Data Exfiltration: Large payloads containing crafted SQL queries or sensitive data could be used to exploit SQL injection vulnerabilities, potentially accessing or corrupting the database.

How to Identify with Example Scenario

How to Resolve with Example Scenario

How to Identify with Example Scenario

Find the text in bold to identify issues such as these in API specifications

How to Resolve with Example Scenario

Modify the text in bold to resolve issues such as these in API specifications
References:

More findings

All Findings