Examkin

Soru

Zorluk: ZorApplication and Software Vulnerabilities

A security analyst is auditing an e-commerce platform's microservice that processes promotional discount codes. During testing, the analyst discovers that when a user sends multiple concurrent asynchronous API requests utilizing the same single-use discount voucher, the application processes several of the requests simultaneously before updating the voucher's status flag to used in the persistent database. Which of the following application vulnerabilities is present, and what is the most effective code-level mitigation strategy?

  1. Race condition (Time-of-Check to Time-of-Use); implement atomic database transactions with thread synchronization or row-level locking.Cevap
  2. B
    Broken authentication; enforce step-up multi-factor authentication (MFA) prior to submitting discount codes.
  3. C
    Improper input validation; deploy web application firewall (WAF) rate-limiting rules on the discount endpoint.
  4. D
    Insufficient logging and monitoring; configure real-time SIEM alerts to notify operators when duplicate voucher IDs are detected.

Cevap

Race condition (Time-of-Check to Time-of-Use); implement atomic database transactions with thread synchronization or row-level locking.
The scenario describes a classic Time-of-Check to Time-of-Use (TOCTOU) race condition where concurrent requests exploit the time delta between verifying a voucher's validity and recording its usage. The proper solution is to enforce atomicity through thread synchronization, row-level database locking, or isolation levels that ensure only one thread can verify and modify the record at a time.

Adım Adım Çözüm

1
Analyze the operational behavior described in the scenario.
Identified that multiple concurrent threads check state independently before any single thread commits a state change, creating an exploit window.
This behavior is characteristic of a Time-of-Check to Time-of-Use (TOCTOU) race condition flaw.
2
Evaluate the underlying root cause of the vulnerability.
The voucher verification logic lacks atomicity and concurrency controls.
Without locking mechanisms, parallel requests read stale state data before the write operation completes.
3
Determine the appropriate remediation control.
Select atomic database operations, thread synchronization, or mutex locks to ensure exclusive processing.
Code-level locking ensures that checking and updating the voucher status occurs as an indivisible, single operation.

Anahtar Kavram

Race Conditions and TOCTOU Vulnerabilities
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru