During a security review of a modern banking web application API, an analyst examines backend request logs and identifies two distinct malicious activity patterns:
1. Requests sent to `/api/v1/profile/upload` include multipart form payload parameters containing filename strings structured as `../../../../etc/passwd`.
2. Requests sent to `/api/v1/statements?account_id=1042` allow authenticated user `1042` to retrieve financial statements belonging to user `1043` simply by changing the `account_id` value in the URL query string.
Which of the following application and software vulnerabilities are directly demonstrated by these log findings? (Select TWO.)
- Directory traversalCevap
- Insecure Direct Object Reference (IDOR)Cevap
- CCross-Site Scripting (XSS)
- DBroken Authentication
Cevap
The correct vulnerabilities demonstrated in the logs are Directory traversal and Insecure Direct Object Reference (IDOR).
The upload payload utilizes relative directory paths (`../`) to escape restricted directories and read host file paths, confirming a Directory Traversal flaw. The account statement request allows an authenticated user to access another user's records simply by changing an unvalidated URL parameter, confirming an Insecure Direct Object Reference (IDOR) flaw.
Adım Adım Çözüm
Anahtar Kavram
Application and Software Vulnerabilities (Directory Traversal & IDOR)
Tahmini Süre:1m 30s