API Abuse WAHS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An e-commerce platform has an admin panel with a REST API. The endpoint DELETE /api/admin/products/{id} is intended for administrators only. During testing, you find that a regular authenticated user can successfully call this endpoint if they change the HTTP method from DELETE to POST. The server processes the POST request and deletes the product. Which of the following is the most likely cause and the best fix?

   • AThe server has a CORS misconfiguration; restrict the allowed origins to prevent cross-origin calls.
   • BThe server is vulnerable to mass assignment; remove the product ID from the request body.
   • CThe server relies on the HTTP method for authorization; enforce authorization checks on the resource and action, not on the method alone.
   • DThe server is using an outdated API version; upgrade to the latest version to fix the vulnerability.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security engineer is reviewing a microservices architecture where each service validates JWTs independently. One service uses a library that only verifies the signature but does not check the "aud" (audience) claim. An attacker obtains a JWT issued for a different service (e.g., the profile service) and uses it to call the admin service. The signature is valid. Which JWT validation flaw is being exploited, and what is the most effective fix?

   • AWeak HMAC secret; rotate to a stronger secret
   • BMissing audience validation; configure each service to verify the aud claim matches its expected audience
   • CToken expiration not enforced; add exp claim validation
   • DAlgorithm confusion; restrict algorithms to RS256 only
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A web application at https://app.example.com makes authenticated AJAX requests to an API at https://api.example.com. The API responds with the header: Access-Control-Allow-Origin: https://app.example.com and Access-Control-Allow-Credentials: true. An attacker discovers that the API also reflects any Origin header sent in the request. Which attack becomes possible?

   • AThe attacker can perform SQL injection through the API
   • BA malicious website can make authenticated cross-origin requests to the API and read the responses
   • CThe attacker can brute-force the API's login endpoint
   • DThe attacker can forge JWTs for the API
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A social media application allows users to update their profile via the endpoint PATCH /api/v1/users/me. The request body is bound directly to the user object in the database. A user discovers they can add the field "role":"admin" to the request body and their account is granted administrator privileges. Which of the following is the most appropriate remediation?

   • AUse a different HTTP method, such as PUT, to update the profile.
   • BAdd a CAPTCHA to the profile update form to prevent automated attacks.
   • CRequire the user to include the role field in every request so the server can validate it.
   • DImplement a whitelist of allowed fields for the update endpoint, excluding sensitive fields like role and permissions.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team discovers that an attacker exploited a broken function-level authorization flaw in an API to delete user accounts over several weeks. The API logs did not record the user ID, the endpoint accessed, or the HTTP status code, so the team cannot determine which accounts were affected or when the attack occurred. Which gap is most directly highlighted?

   • AWeak JWT secret
   • BInsufficient API logging and monitoring
   • CRate limiting failure
   • DCORS misconfiguration
   Reveal Solution Discussion Select an answer first