Examkin

Soru

Zorluk: ZorApplication and Software Vulnerabilities

During a security assessment of a web portal's user profile microservice, a security analyst reviews the API request handling logic. The microservice accepts a JSON payload for profile updates and automatically maps all incoming key-value pairs directly to the backend database user model without filtering. Furthermore, when users supply a web URL to import a profile avatar, the server issues an HTTP request to retrieve the image using service privileges without validating the target destination host or IP address. Which of the following application vulnerabilities are present in this scenario? (Select TWO.)

  1. Server-Side Request Forgery (SSRF)Cevap
  2. Mass AssignmentCevap
  3. C
    Command Injection
  4. D
    Broken Authentication

Cevap

The correct vulnerabilities are Server-Side Request Forgery (SSRF) and Mass Assignment.
The scenario demonstrates two specific software flaws: issuing server-side HTTP requests to client-provided URLs without destination validation is Server-Side Request Forgery (SSRF), and automatically mapping untrusted JSON input fields directly into the backend database object is Mass Assignment.

Adım Adım Çözüm

1
Analyze the remote avatar fetching behavior
The application issues outbound HTTP requests based on user-supplied URLs without restricting target IP addresses or domain names.
Allowing an untrusted client input to trigger backend network requests to arbitrary destinations defines Server-Side Request Forgery (SSRF).
2
Analyze the profile payload processing behavior
The application automatically binds all client-provided JSON key-value pairs directly to the backend database object.
Unfiltered binding of client HTTP request parameters to internal object properties defines Mass Assignment.

Anahtar Kavram

Identifying Software and API Vulnerabilities (SSRF and Mass Assignment)
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru