Examkin

Question

Difficulty: HardApplication and Software Vulnerabilities

During a security assessment of a web portal's user profile microservice, a security analyst reviews the API request handling logic. The microservice accepts a JSON payload for profile updates and automatically maps all incoming key-value pairs directly to the backend database user model without filtering. Furthermore, when users supply a web URL to import a profile avatar, the server issues an HTTP request to retrieve the image using service privileges without validating the target destination host or IP address. Which of the following application vulnerabilities are present in this scenario? (Select TWO.)

  1. Server-Side Request Forgery (SSRF)Answer
  2. Mass AssignmentAnswer
  3. C
    Command Injection
  4. D
    Broken Authentication

Answer

The correct vulnerabilities are Server-Side Request Forgery (SSRF) and Mass Assignment.
The scenario demonstrates two specific software flaws: issuing server-side HTTP requests to client-provided URLs without destination validation is Server-Side Request Forgery (SSRF), and automatically mapping untrusted JSON input fields directly into the backend database object is Mass Assignment.

Step-by-Step Solution

1
Analyze the remote avatar fetching behavior
The application issues outbound HTTP requests based on user-supplied URLs without restricting target IP addresses or domain names.
Allowing an untrusted client input to trigger backend network requests to arbitrary destinations defines Server-Side Request Forgery (SSRF).
2
Analyze the profile payload processing behavior
The application automatically binds all client-provided JSON key-value pairs directly to the backend database object.
Unfiltered binding of client HTTP request parameters to internal object properties defines Mass Assignment.

Key Concept

Identifying Software and API Vulnerabilities (SSRF and Mass Assignment)
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic