Active defense: introducing a stateful vulnerability scanner for APIs

Cloudflare is launching a beta Web and API Vulnerability Scanner to actively detect API logic flaws that defensive tools often miss. Its first target is Broken Object Level Authorization (BOLA), where authenticated users can access or modify another user’s resources through valid requests. The scanner combines Cloudflare’s existing API visibility with stateful DAST to test authorization across sequences of API calls.

Why Defensive Security Misses API Logic Flaws

• Traditional WAFs are effective against recognizable attacks such as SQL injection, XSS, malformed requests, and suspicious payloads.
• API vulnerabilities often involve valid requests that violate business rules rather than protocol or schema requirements.
• In the food delivery example:
  • User A sends a valid PATCH request for User B’s order.
  • User A’s token, headers, and request schema are all legitimate.
  • The vulnerability exists because the API fails to verify that User A owns the order.
• A basic authorization check could prevent the issue:

  if (order.userID != user.ID) throw Unauthorized;
  

Passive Detection and the Limits of Traditional DAST

• Cloudflare’s existing API Shield BOLA detection passively analyzes customer traffic for abnormal usage patterns.
• Effective passive detection requires context about:
  • Valid API calls
  • Variable parameters
  • Normal user behavior
  • API responses when parameters are manipulated
• Passive analysis may be insufficient in development environments with little traffic or production systems without observed attacks.
• DAST creates new traffic specifically for security testing and can operate in environments without relevant user activity.
• Traditional DAST tools often:
  • Require extensive configuration
  • Depend on manually maintained Swagger/OpenAPI files
  • Struggle with modern authentication flows
  • Lack API-specific tests such as BOLA detection

Cloudflare’s API Scanning Advantage

• Scan results will appear in Security Insights alongside other Cloudflare security findings.
• API Shield customers already benefit from Cloudflare’s API Discovery and Schema Learning, which catalog endpoints and learn traffic patterns.
• The initial release requires an uploaded OpenAPI specification, though future versions are expected to work without one.
• Cloudflare can use passive traffic inspection to identify possible BOLA issues and actively verify them with new HTTP requests.
• Customers provide API credentials, while Cloudflare uses API schemas to construct a scan plan automatically.

Stateful API Scanning

• Conventional scanners often evaluate requests independently, making it difficult to test vulnerabilities that require a sequence of related actions.
• BOLA testing may require:
  • Creating a resource as one user
  • Attempting to access or modify it as another user
  • Comparing the resulting behavior
• Cloudflare’s scanner builds an API call graph from the OpenAPI document.
• It walks that graph using separate owner and attacker contexts:
  • Owners create resources.
  • Attackers use their own valid credentials to attempt access.
• This stateful approach is designed to test authorization across realistic API workflows rather than isolated requests.

Cloudflare’s scanner is intended to complement—not replace—passive monitoring and edge defenses. Organizations should use the beta to actively test APIs, especially authorization controls, in environments where normal traffic provides insufficient security context.