Schema enumeration is an attack that probes API parameters to discover hidden database fields, columns, or configuration details. It often targets unconstrained string parameters such as sortBy. section 6.3
Discovering a hidden product property
Suppose GET /products accepts sortBy values such as name, price, and rating. Sorting by asdf causes an error, but sorting by is_exclusive succeeds. Comparing these responses reveals that is_exclusive is a hidden product property, potentially exposing sensitive data or configuration. section 6.3
Reduce the attack surface with focused controls:
- Constrain predictable parameters with enumerations; for example, permit only price, review, and name for sortBy. section 6.3
- Keep genuinely flexible filters usable, but parameterize every database query to prevent SQL injection. section 6.3
- Test invalid and unexpected parameter values for revealing errors, successful access to hidden properties, and other abnormal responses. section 6.3 section 6.7
