Description

The API allows unauthenticated users to access sensitive personally identifiable information (PII), which may not be intended.

What are considered sensitive personally identifiable information (PII)?

Sensitive PII is information that, if inadvertently disclosed, could have significant consequences for the data subject. Sensitive PII data can encompass a wide range of information, including:

• Health information, covering medical records or insurance information.
• Government information, which includes social security information or other government related data.
• Proprietary information, which includes secrets or intellectual property (IP).

Note: Datadog is only able to detect certain types of PII.

Rationale

This finding works by identifying an API that:

• Lacks an authentication mechanism.
• Replies with or accepts requests containing one or more of the following:
  • Social Security Number (US)
  • Social Insurance Number (UK)
  • Passport Number
  • Vehicle Identification Number

Remediation

• Validate that the code isn’t expecting the user to be authenticated to have access to this resource (AuthN). In case this API it is in fact authenticated, ensure your code is instrumented correctly. Datadog auto-instruments many event types, review your instrumented business logic events.
• Validate whether the API is intended to return PII.

References