Examkin

Soru

Zorluk: OrtaApplication and Software Vulnerabilities

During a financial audit of a modern web application, security engineers discover that concurrent asynchronous POST requests to the payment endpoint allow users to apply a single-use promotional credit code multiple times simultaneously before the database updates the credit balance to zero. Which of the following application vulnerabilities is being exploited in this scenario?

  1. Time-of-check to time-of-use (TOCTOU) race conditionCevap
  2. B
    Cross-site scripting (XSS)
  3. C
    Insecure direct object reference (IDOR)
  4. D
    Web application firewall (WAF) misconfiguration

Cevap

Time-of-check to time-of-use (TOCTOU) race condition
The correct answer correctly identifies the vulnerability as a race condition, specifically a time-of-check to time-of-use (TOCTOU) flaw. When multiple asynchronous requests execute simultaneously, the application checks the credit balance validity for all threads before any single thread finishes updating the balance, allowing duplicate redemptions.

Adım Adım Çözüm

1
Analyze the reported application behavior
Multiple asynchronous requests are processed simultaneously to reuse a single-use resource before the database state updates.
Identifying the root cause requires understanding how timing and state changes interact during concurrent processing.
2
Evaluate vulnerability classifications
The flaw occurs because the system validates state at time t1t_1 (check) and modifies state at time t2t_2 (use), creating a window for exploit via concurrent threads.
This timing window between validation and execution is the defining characteristic of a TOCTOU race condition.

Anahtar Kavram

Race Conditions and Concurrency Issues (TOCTOU)
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru