Common Threats on Authentication and Authorization CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Java web application allows users to view their own orders via a URL like /order?id=12345. A penetration test reveals that changing the id parameter to another user's order returns that order's details. The application uses session-based authentication and checks that the user is logged in, but does not verify that the order belongs to the logged-in user. Which two controls would most directly fix this vulnerability and prevent similar IDOR issues?

   • AUse a POST request instead of GET for order viewing, and rely on the session to identify the user without checking the order owner.
   • BEncrypt the order ID with a secret key and include it in the URL, but do not add a server-side ownership check.
   • CAdd a CAPTCHA to the order page and increase the session timeout to reduce the window for an attacker to guess IDs.
   • DImplement object-level authorization checks in the controller that compare the requested order's owner with the authenticated user, and use indirect references such as random GUIDs for order IDs.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Java application has a URL pattern /admin/* that is protected by a security filter. However, the application also uses URL rewriting to handle pretty URLs, and the filter is applied before URL rewriting. An attacker discovers that they can access admin functionality by requesting a URL that, after rewriting, maps to /admin/dashboard. What is the most likely cause of this authorization bypass?

   • AThe security filter uses a blacklist of admin URLs, which is incomplete and does not include all possible rewritten forms.
   • BThe security filter is applied before URL rewriting, so it checks the original URL, not the rewritten one, allowing the rewritten URL to bypass the filter.
   • CThe application does not use HTTPS, allowing an attacker to intercept the rewritten URL and modify it.
   • DThe application stores the user's role in a cookie that can be modified by the attacker.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Java web application uses a session cookie that is valid for 24 hours. A user reports that after changing their password, they are still able to access their account without re-authenticating on another device. What is the most likely cause and the appropriate fix?

   • AThe session timeout is too long; reduce it to 15 minutes.
   • BThe user's password was not actually changed; verify the password change process.
   • CThe session cookie is not set with the Secure flag; enable Secure to prevent access after password change.
   • DThe application does not invalidate existing sessions after a password change; implement session invalidation and re-authentication after password changes.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A web application uses a numeric identifier in the URL to display user profile details. An attacker changes the identifier to another user's number and views that user's private data without authorization. Which authorization threat does this illustrate?

   • AInsecure Direct Object Reference (IDOR)
   • BSession fixation
   • CForced browsing
   • DPrivilege escalation
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   An attacker discovers that by manually entering the URL for an admin panel (e.g., /admin) they can access administrative functions even though no link to that page is shown in the user interface. Which authorization threat is this?

   • AIDOR
   • BPrivilege escalation
   • CForced browsing
   • DCross-site request forgery (CSRF)
   Reveal Solution Discussion Select an answer first