Examkin

Soru

Zorluk: OrtaApplication and Software Vulnerabilities

A security analyst is reviewing application event logs following a report of data exposure in a web portal. The log entries indicate that authenticated users are altering the `user_id` query parameter in the HTTP GET request (`GET /api/v1/profile?user_id=8834`) to retrieve private profile data belonging to other accounts without any server-side validation of ownership. Which of the following security vulnerabilities is demonstrated in this scenario, and what is the most appropriate control to remediate it?

  1. A
    Broken Authentication; remediate by enforcing multi-factor authentication (MFA) and shorter session timeouts across all portal endpoints.
  2. Insecure Direct Object Reference (IDOR); remediate by implementing server-side object-level authorization checks.Cevap
  3. C
    Cross-Site Scripting (XSS); remediate by applying contextual HTML output encoding to user-supplied query parameters.
  4. D
    Insecure Direct Object Reference (IDOR); remediate by deploying an edge Web Application Firewall (WAF) to filter inspectable HTTP request headers.

Cevap

Insecure Direct Object Reference (IDOR); remediate by implementing server-side object-level authorization checks.
The correct answer identifies the vulnerability as Insecure Direct Object Reference (IDOR) and recommends server-side object-level access control. IDOR occurs when an application uses client-provided input to access objects directly (such as database keys or account numbers in URL parameters) without performing server-side authorization checks to verify that the requester owns or is permitted to view the requested data.

Adım Adım Çözüm

1
Analyze the log entries and exploit pattern.
Identified that authenticated users manipulate a direct parameter (`user_id=8834`) to access records belonging to other users.
Direct reference manipulation to bypass access constraints is the defining characteristic of an Insecure Direct Object Reference (IDOR) flaw.
2
Distinguish between authentication failure and authorization failure.
Determined that the system successfully verified identity (authentication) but failed to restrict access based on resource ownership (authorization).
Remediation requires validating whether the logged-in session identity is authorized to access the specific record requested.
3
Select the appropriate server-side mitigation control.
Selected server-side object-level authorization checks.
Enforcing access controls directly at the code/data layer ensures every request verifies the user's permission to access that specific object key.

Anahtar Kavram

Insecure Direct Object Reference (IDOR) and Object-Level Access Control
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru