Privilege Escalation WAHS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A web application allows users to view their own invoices via a URL like /invoice?id=1001. A penetration tester discovers that changing the id parameter to 1002 displays another user's invoice. Which of the following is the most appropriate immediate fix?

   • AAdd a client-side JavaScript check that compares the invoice number to the user's session before displaying it.
   • BChange the id parameter from a sequential integer to a random UUID.
   • CAdd an authorization check in the server-side code to verify the invoice belongs to the authenticated user before returning it.
   • DImplement rate limiting on the /invoice endpoint to slow down automated enumeration attempts.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A web application has an API that allows users to update their profile. The API accepts a 'userId' parameter in the request body. A user changes the 'userId' to another user's ID and successfully updates that user's email address. The application uses session-based authentication. What is the most effective fix?

   • AUse a hidden field to store the current user ID.
   • BValidate that the 'userId' parameter is a positive integer.
   • CIgnore the 'userId' parameter and derive the user ID from the server-side session.
   • DAdd a CSRF token to the API request.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An application uses a JWT token stored in a cookie to identify the user. The token contains a 'role' claim. A user modifies the token's role from 'user' to 'admin' and re-encodes it, gaining admin access. What is the most likely root cause and the best fix?

   • AThe JWT is not signed; use a strong signing algorithm and verify the signature on every request.
   • BThe JWT has a short expiration; increase the expiration time.
   • CThe JWT is stored in a cookie; move it to local storage.
   • DThe JWT is encrypted; use a weaker encryption to allow decoding.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a legacy web application with multiple admin functions scattered across different controllers. A security audit finds that some admin functions lack authorization checks. The team wants to fix this without rewriting the entire application. What is the most practical approach?

   • AImplement a global middleware that checks the user's role for all requests to admin paths.
   • BUse a web application firewall (WAF) to block access to admin paths.
   • CRemove all admin functions from the application.
   • DAdd a comment in the code reminding developers to add checks later.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A web application has an administrative panel at /admin. The application only hides the link to this panel from regular users, but does not enforce any server-side authorization check. A regular user directly navigates to /admin and gains access. Which vulnerability is this?

   • AMissing Function-Level Access Control
   • BSecurity Misconfiguration
   • CBroken Authentication
   • DInsecure Direct Object Reference
   Reveal Solution Discussion Select an answer first