Active defense: introducing a stateful vulnerability scanner for APIs

Cloudflare introduces a stateful Web and API Vulnerability Scanner in beta, starting with detection of Broken Object Level Authorization (BOLA) vulnerabilities.

• •BOLA attacks use valid, authenticated HTTP requests to access resources belonging to other users, making them invisible to traditional WAFs that only detect syntax-based threats
• •The scanner uses a stateful DAST approach, building an API call graph from OpenAPI schemas to model endpoint dependencies and chain requests in logical sequences
• •Unlike traditional DAST tools, Cloudflare's scanner leverages existing API Discovery and Schema Learning data to automatically construct scan plans without manual configuration
• •The tool runs scans using both an "owner" context (to create resources) and an "attacker" context (to attempt unauthorized access), flagging successful unauthorized reads, modifications, or deletions