Broken Cryptography and Cross-Tenant Data Exposure

Modern cyberattacks are increasingly targeting weaknesses in web application design rather than traditional infrastructure vulnerabilities. Instead of exploiting operating systems or deploying malware, attackers are focusing on insecure API implementations, exposed cryptographic secrets, and weaknesses in authorization controls to access sensitive information or manipulate trusted application workflows.

Recent security assessments continue to reveal recurring issues such as Broken Cryptography and Cross-Tenant Sensitive Information Disclosure, both of which can allow authenticated users to abuse legitimate application functionality without exploiting the underlying infrastructure.

Because these attacks originate from valid user sessions and often resemble normal application traffic, they can evade traditional security controls. As organizations continue to adopt API-driven and cloud-native applications, secure application design, API security, and continuous monitoring have become essential to reducing cyber risk.

Understanding the Risks

Broken Cryptography:

Encryption protects sensitive information as it moves between users and an application. However, if the "keys" or secret values used to perform that encryption are exposed within the application itself, the protection can be bypassed.

Some web applications unintentionally store these secrets inside code that is downloaded to every user's browser. When combined with information from an authenticated user session, attackers may be able to recreate the same encryption process used by the application.

This allows them to read, modify, and resend protected requests without appearing suspicious because the application sees them as a legitimate, logged-in user.

In other words, the attacker is not breaking the encryption—they are using the application's own encryption process against it.

Cross-Tenant Sensitive Information Disclosure

Cross-tenant data exposure occurs when a web application unintentionally returns information belonging to other users, customers, or organizations.

Although the application's interface may hide this information, backend APIs sometimes return far more data than the user is authorized to access. This hidden data can often be viewed through browser developer tools or by inspecting network traffic.

These weaknesses commonly stem from insufficient authorization checks, excessive data exposure, or insecure API design.

Attackers do not require administrative privileges to exploit these flaws. A legitimate user account may be enough to collect sensitive customer records, business information, or personally identifiable information (PII) that should never have been accessible.

Why Organizations Should Care

Modern applications rely heavily on APIs to exchange data and deliver services. As a result, attackers are increasingly targeting application logic and API behavior rather than infrastructure vulnerabilities.

Successful exploitation of these weaknesses may lead to:

• Unauthorized disclosure of sensitive customer or business information.

• Manipulation of financial or business transactions.

• Identity theft and targeted social engineering attacks.

• Regulatory and compliance violations resulting from data exposure.

• Fraud carried out through legitimate user accounts.

• Long-term abuse that remains undetected because the activity appears to originate from authenticated users.

Unlike traditional attacks, these activities often generate few obvious security alerts, making early detection significantly more challenging.

What Developers Should Consider

Building secure applications requires more than implementing encryption,it requires ensuring that encryption, authorization, and data handling are designed securely from the outset.

Development teams should:

• Never store cryptographic keys, salts, or other sensitive secrets within client-side code.

• Perform encryption and key management on trusted server-side components.

• Validate user authorization on every API request instead of relying on frontend controls.

• Return only the minimum amount of data required to complete each request.

• Enforce object-level authorization across all API endpoints.

• Review API responses for unnecessary exposure of sensitive information.

• Integrate secure code reviews and penetration testing into the development lifecycle.

• Include API security testing within CI/CD pipelines before production deployment.

What Security Teams Should Monitor

Areas that warrant closer attention include:

• Unusual API request volumes from authenticated users.

• Repeated access to sensitive endpoints.

• Large or abnormal API responses delivered to standard user accounts.

• Unexpected changes to customer profiles, financial information, or business workflows.

• High-risk actions that differ from a user's normal behaviour.

• Indicators of API enumeration or automated data harvesting.

• Access patterns that deviate from established behavioural baselines.

Combining API monitoring with behavioural analytics can help identify application abuse that traditional endpoint and network security controls may overlook.

Best Practices for Secure Web Application Development

Organizations should incorporate the following security principles into application development and operations:

• Adopt a Secure Software Development Lifecycle (SSDLC).

• Enforce least-privilege access across applications and APIs.

• Store cryptographic secrets securely using dedicated secrets management solutions.

• Perform server-side validation for every request.

• Conduct regular API security assessments and penetration testing.

• Apply Zero Trust principles to application access.

• Continuously monitor API activity for anomalous behavior.

• Perform periodic threat modeling to identify potential design weaknesses before deployment.

‍