Business Logic Abuse in APIs: The Vulnerabilities Scanners Can't Find

Why Scanners Miss Business Logic Flaws

Automated security scanners (SAST, DAST, IAST) excel at finding technical vulnerabilities — SQL injection, XSS, missing headers. But they fundamentally cannot understand your business rules. A business logic vulnerability exists when an API allows actions that are technically valid but violate the intended business workflow.

Definition: A business logic vulnerability occurs when an attacker exploits legitimate application functionality in unintended ways to achieve a malicious goal. The requests are well-formed, authenticated, and pass all input validation — but the outcome violates business intent.

---

The Cost of Business Logic Abuse

---

The 10 Most Common Business Logic Abuses

1. Price Manipulation

Attack: Modify prices in API requests before checkout.

# Legitimate request
POST /api/checkout
{ "items": [{ "id": "laptop-001", "price": 999.99, "qty": 1 }] }

# Attack — Client sends modified price
POST /api/checkout
{ "items": [{ "id": "laptop-001", "price": 0.01, "qty": 1 }] }

Fix: Never trust client-sent prices. Always look up prices server-side.

async function checkout(req: Request) {
  const cart = req.body.items;

  // Look up REAL prices from database for each item
  const priced = await Promise.all(
    cart.map(async (item: any) => {
      const product = await Product.findById(item.id);
      return {
        productId: product.id,
        price: product.currentPrice, // From database, NOT from client
        quantity: Math.min(item.qty, product.stockCount),
      };
    })
  );

  const total = priced.reduce((sum, i) => sum + i.price * i.quantity, 0);
  return processPayment(total, priced);
}

2. Coupon / Discount Stacking

Attack: Apply the same coupon multiple times or combine coupons that shouldn't stack.

3. Race Conditions

Attack: Send concurrent requests to exploit time-of-check-to-time-of-use (TOCTOU) vulnerabilities.

# User has $100 balance
# Sends 5 simultaneous requests to transfer $100

T0: Request 1 → Check balance: $100 ✓ → Process transfer
T0: Request 2 → Check balance: $100 ✓ → Process transfer  
T0: Request 3 → Check balance: $100 ✓ → Process transfer
T0: Request 4 → Check balance: $100 ✓ → Process transfer
T0: Request 5 → Check balance: $100 ✓ → Process transfer

Result: $500 transferred from $100 balance!

Fix — Use database-level atomic operations:

// VULNERABLE — Read-then-write race condition
const user = await User.findById(userId);
if (user.balance >= amount) {
  user.balance -= amount;
  await user.save();
}

// SECURE — Atomic database operation
const result = await User.findOneAndUpdate(
  {
    _id: userId,
    balance: { $gte: amount }, // Check AND update atomically
  },
  {
    $inc: { balance: -amount },
  },
  { new: true }
);

if (!result) {
  throw new Error("Insufficient balance");
}

4. Enumeration / Scraping

Systematic crawling of API endpoints to extract entire datasets.

5. Workflow Bypass

Skipping required steps by calling API endpoints out of order.

Normal flow: Select Item → Add to Cart → Enter Shipping → Enter Payment → Confirm

Attack: Skip payment step by directly calling /api/orders/confirm

Prevention: Implement a state machine for multi-step workflows. Each API endpoint verifies the current state before proceeding.

6. Loyalty Points Manipulation

7. Excessive Function Execution

8. Feature Flag Abuse

9. Free Tier Abuse

Creating unlimited accounts to abuse free tiers.

10. Review / Rating Manipulation

---

Detection Strategies

Behavioral Analysis

Since individual requests look legitimate, detection requires analyzing sequences of requests:

Anomaly Detection Approach

Baseline (learn normal):
- Average checkout time per user: 3-10 minutes
- Average coupon applications per order: 0.3
- Average API calls per session: 15-25
- Payment attempt success rate: 87%

Alert when:
- Checkout time < 5 seconds (bot behavior)
- Coupon applications per order > 1 (stacking attempt)
- API calls per session > 100 (enumeration)
- Payment attempt success rate < 10% (card testing)

---

Prevention Architecture

---

Further Reading

• API Security Trends 2026 — Broader API threat landscape
• OWASP API Security Top 10 — API6: Unrestricted Access to Sensitive Business Flows
• Secure API Design Patterns — Building secure APIs from the start