Common Threats on Authentication and Authorization CASEJAVA Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A Java web application has an admin panel at /admin that is not linked in the UI. A regular user discovers they can access the panel by typing the URL directly. The application uses role-based access control (RBAC) but only hides the admin link from non-admin users. Which vulnerability is this, and what is the most effective fix?

   • AIDOR; randomize the admin URL to make it unguessable.
   • BForced browsing; implement server-side authorization checks on every admin endpoint.
   • CPrivilege escalation; disable the admin panel for all users.
   • DSession fixation; regenerate the session ID after login.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A Java application has a role-based access control system where users can have multiple roles. The application uses a JWT that contains the user's roles. A security review finds that the JWT is signed with a weak algorithm (HS256) and the secret key is hardcoded in the source code. An attacker extracts the key and forges a JWT with the 'admin' role. Which two vulnerabilities are present, and what is the most effective combined mitigation?

   • APrivilege escalation and brute force; implement account lockout and rate limiting.
   • BSession fixation and IDOR; rotate session IDs and validate object ownership.
   • CForced browsing and credential stuffing; hide admin links and use MFA.
   • DWeak JWT signing and hardcoded secrets; use a strong asymmetric algorithm (RS256) and store the private key securely in a vault.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A Java application uses a session-based authentication mechanism. The application sets a session cookie without the Secure flag, and the site is accessible over both HTTP and HTTPS. A security review finds that the session ID is generated using a weak random number generator. Which of the following is the most likely attack that could succeed?

   • AForced browsing, because the attacker can directly access restricted pages without a valid session.
   • BSession hijacking via network sniffing, because the session cookie can be intercepted over HTTP, or via prediction if the attacker can guess the weak session ID.
   • CPrivilege escalation, because the attacker can modify the session cookie to change their role.
   • DCredential stuffing, because the attacker uses stolen credentials to log in and obtain a valid session.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A Java application uses a login form that submits credentials over HTTPS. The application has a 'remember me' feature that stores a persistent cookie with the user's username and a hash of the password. A security review finds that the cookie is not HttpOnly and is not scoped to a specific device. Which of the following is the most significant risk associated with this 'remember me' implementation?

   • AAn attacker who steals the cookie via XSS can impersonate the user without needing the password, and the cookie remains valid across devices.
   • BThe cookie will be sent over HTTP if the user visits a non-HTTPS page, exposing the password hash to network sniffing.
   • CThe cookie will be stored in plain text on the user's device, allowing anyone with local access to read it.
   • DThe cookie will expire quickly, causing users to be logged out frequently and reducing usability.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A Java application has a REST API that allows users to update their profile. The API endpoint is /api/profile and accepts a JSON payload. A security audit finds that the endpoint does not check whether the authenticated user is allowed to modify the 'role' field. An attacker sends a request with 'role': 'admin' and successfully escalates privileges. What is the most appropriate fix?

   • AAdd a client-side check in the JavaScript code to hide the 'role' field from the form.
   • BEncrypt the JSON payload with a secret key and require the client to include a checksum.
   • CUse a POST request instead of PUT for profile updates, and rely on the HTTP method to prevent privilege escalation.
   • DUse a DTO (Data Transfer Object) that only includes the fields the user is allowed to modify, and enforce authorization checks on the server side.
   Reveal Solution Discussion Select an answer first