Insecure Direct Object References (IDOR) WAHS Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A post-mortem of a major IDOR breach reveals that the application had authentication, rate limiting, and logging, but still allowed users to access other users' data by changing an ID. Which missing control is the most likely root cause?

   • ATransport layer security (TLS)
   • BNetwork segmentation
   • CObject-level authorization checks
   • DStrong password policy
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A well-known social media platform suffered a data breach where attackers accessed private photos of millions of users by changing numeric photo IDs in API requests. Which lesson is most directly illustrated by this case?

   • AUsing HTTPS is sufficient to protect data in transit from unauthorized access
   • BRate limiting is the primary defense against IDOR
   • CIDOR vulnerabilities only affect legacy applications
   • DAPIs that expose direct object references without authorization checks can lead to mass data exposure
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   During a security review, you notice a URL pattern like /api/v1/users/12345/orders. What should you investigate to determine if an IDOR vulnerability exists?

   • AWhether the URL uses HTTPS to encrypt the request.
   • BWhether the application validates the '12345' value against the authenticated user's identity before returning order data.
   • CWhether the '12345' value is a valid integer.
   • DWhether the 'orders' endpoint is documented in the API reference.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security tester is examining a REST API that allows users to update their profile. The endpoint is PUT /api/v1/users/{userId}/profile. The tester changes the userId in the URL to another user's ID and successfully modifies that user's email address. Which exploitation technique was used?

   • ASession hijacking by stealing the victim's session cookie
   • BParameter tampering with a direct object reference to perform an unauthorized action
   • CCross-site scripting to execute JavaScript in the victim's browser
   • DHTTP request smuggling to bypass authentication
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A financial services company discovered that users can view other customers' transaction histories by changing the 'txnId' parameter in the API endpoint /api/v1/transactions/{txnId}. The development team wants to fix this without breaking existing client integrations that rely on the current URL structure. Which mitigation approach best addresses the root cause while preserving the API contract?

   • AReplace the numeric transaction ID with a randomly generated UUID in the URL
   • BImplement server-side authorization checks that verify the authenticated user owns the requested transaction before returning data
   • CLog all requests to the transaction endpoint and review them periodically
   • DAdd input validation to ensure the txnId parameter contains only digits
   Reveal Solution Discussion Select an answer first