Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

A security analyst is investigating an anomaly in an e-commerce platform's reward point redemption API. During peak traffic events, logs reveal that multiple concurrent API requests using the same single-use discount coupon resulted in repeated point deductions beyond the user's actual balance. Code review shows that the application checks the remaining balance in one database query and updates the record in a subsequent query without synchronization. Which of the following vulnerabilities and mitigation strategies are identified in this scenario? (Select TWO.)

  1. The application exhibits a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability.Answer
  2. Implementing database row-level locking or atomic transactions mitigates the vulnerability.Answer
  3. C
    The vulnerability is caused by a DOM-based Cross-Site Scripting (XSS) payload manipulating the API response.
  4. D
    Deploying an inline web application firewall with strict IP rate limiting fully resolves the underlying software vulnerability.

Answer

The application suffers from a Time-of-Check to Time-of-Use (TOCTOU) race condition, which can be remediated by implementing database row-level locking or atomic transaction controls.
The scenario describes a classic Time-of-Check to Time-of-Use (TOCTOU) race condition where separate check and write operations allow concurrent requests to bypass validation rules. Remediating this requires software-level controls such as database row locking, mutex locks, or atomic transaction handling to ensure thread safety.

Step-by-Step Solution

1
Analyze the reported behavior and system logs.
Concurrent requests succeed because checking the user balance and updating the account occur in distinct, non-atomic steps.
This timing window creates a race condition known as Time-of-Check to Time-of-Use (TOCTOU).
2
Determine the appropriate application-level remediation.
Enforce atomic database operations or mutex locking mechanisms during state validation.
Atomic transactions prevent other threads or requests from inspecting or altering state until the transaction completes.

Key Concept

Race Conditions and TOCTOU Vulnerabilities in Software Applications
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic