Insecure Direct Object References (IDOR) WAHS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the most effective mitigation for an IDOR vulnerability?

   • AUsing a Web Application Firewall (WAF) to block suspicious requests.
   • BUsing HTTPS to encrypt all traffic.
   • CAdding CAPTCHA to forms.
   • DImplementing server-side access control checks to verify the user's authorization for every object request.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company's web application uses sequential numeric IDs for user profiles. A security audit recommends replacing them with indirect reference maps. What is the primary benefit of this mitigation?

   • AIt encrypts all data in transit automatically.
   • BIt eliminates the need for server-side authorization checks.
   • CIt speeds up database queries by using shorter IDs.
   • DIt prevents attackers from guessing or enumerating valid object references.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A development team is fixing an IDOR vulnerability in a REST API. They plan to add authorization checks to each endpoint. However, they are concerned about performance and code duplication. Which approach balances security and maintainability?

   • AAdd authorization checks only to endpoints that handle sensitive data.
   • BRely on the database to restrict access using row-level security.
   • CCreate a reusable authorization service that endpoints call to verify object ownership.
   • DUse a WAF to block requests that appear to be tampering with IDs.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A bug bounty hunter finds an IDOR in a banking application that allows viewing other users' transaction history by changing the 'account_id' parameter. The hunter reports it as critical. Why is this considered a high-severity issue?

   • AIt causes the application to crash for all users.
   • BIt leads to unauthorized disclosure of sensitive financial data, which can cause fraud and identity theft.
   • CIt allows the attacker to modify the bank's interest rates.
   • DIt allows the attacker to bypass the login page.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare application allows patients to view their lab results via /results?id=123. A patient discovers that by changing the id to 124, they can view another patient's lab results, including HIV test status. Which impact is most severe?

   • AThe application becomes slower due to increased requests
   • BThe patient's own results are no longer accessible
   • CThe patient could modify the lab results
   • DUnauthorized disclosure of highly sensitive medical information, leading to legal and ethical violations
   Reveal Solution Discussion Select an answer first