Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

An application security auditor reviews network traffic logs and backend code snippets for a cloud-hosted Web API. The audit reveals two specific behaviors:

1. When a client submits a malformed query request, the server responds with an HTTP 500 Internal Server Error containing full stack traces, database schema details, and unhandled exception data.
2. The endpoint `/api/v1/account` accepts a user-supplied parameter `account_id` and retrieves requested profile records without checking whether the requesting user's token has permission to access that specific account.

Which of the following application vulnerabilities are directly illustrated by these findings? (Select TWO).

  1. Improper error handling leading to sensitive information disclosureAnswer
  2. Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR)Answer
  3. C
    Cross-Site Scripting (XSS) reflected through HTTP headers
  4. D
    Lack of Multi-Factor Authentication (MFA) enforcement on identity endpoints

Answer

The application exhibits improper error handling (information disclosure via raw stack traces) and Broken Object Level Authorization / Insecure Direct Object Reference (accessing unauthorized records via parameter manipulation).
The correct selections describe the two distinct findings in the scenario: exposing raw stack traces and internal schema information when errors occur is improper error handling, while trusting user-supplied resource identifiers without enforcing permissions is Insecure Direct Object Reference (IDOR) / Broken Object Level Authorization (BOLA).

Step-by-Step Solution

1
Analyze Finding 1 (Server Error Behavior)
The server exposes internal database schemas and full application stack traces upon receiving invalid inputs.
This represents improper error handling, which discloses sensitive implementation details that aid attackers in reconnaissance.
2
Analyze Finding 2 (API Endpoint Behavior)
The application allows clients to supply arbitrary `account_id` values and fetches data without comparing the user's session rights against the target resource.
This is an Insecure Direct Object Reference (IDOR), also classified under OWASP as Broken Object Level Authorization (BOLA).
3
Evaluate Incorrect Distractors
Discard XSS and MFA options as they confuse client-side script injection and identity verification with internal trace exposure and access authorization checks.
Ensures precise categorization of vulnerability classes according to standard application security taxonomies.

Key Concept

Identifying application security vulnerabilities including information disclosure via improper error handling and authorization flaws like IDOR/BOLA.
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic