Privilege Escalation WAHS Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A file-sharing application allows users to download files via /download?file=report.pdf. A user discovers that by changing the filename to 'admin_notes.pdf', they can download a file belonging to an administrator. The application stores files in a directory with the owner's username as a subdirectory. Which of the following is the best fix?

   • AConstruct the file path on the server using the authenticated user's username and validate that the requested file is within that user's directory.
   • BSet the file permissions on the server so that only the owner can read their files.
   • CStore files in a database and use a random file ID instead of the filename.
   • DAdd a file extension whitelist to only allow .pdf files to be downloaded.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A development team is fixing a privilege escalation vulnerability where a user can access another user's private messages by changing a numeric message ID in the URL. They plan to add a check that compares the message owner ID with the session user ID. Which additional control should they implement to prevent attackers from bypassing this check?

   • AStore the session user ID in a client-side cookie and compare it with the message owner ID.
   • BLog all access attempts and review them periodically.
   • CEnsure the authorization check is performed server-side on every request, not just in the client-side code.
   • DUse a random, unguessable message ID instead of a sequential number.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A support portal allows customers to view their tickets via /ticket?id=123. A customer discovers that by changing the id to 456, they can view another customer's ticket. The application uses a shared database and the ticket records include a 'customer_id' field. Which of the following is the best way to fix this vulnerability?

   • AAdd a 'ticket_owner' column to the ticket table and populate it with the customer's username.
   • BEncrypt the ticket ID in the URL using a symmetric cipher.
   • CModify the server-side query to include a WHERE clause that filters tickets by the authenticated customer's ID.
   • DUse a random, unguessable ticket ID instead of sequential numbers.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An e-commerce site allows users to view their orders via a URL like /order?id=12345. A penetration tester discovers that changing the id to another user's order number displays that order's details. What is the most appropriate classification and mitigation?

   • AMissing function-level access control; add a role check to the order page.
   • BInsecure direct object reference; use unpredictable order IDs generated by a UUID.
   • CHorizontal privilege escalation; implement object-level authorization checks to verify the order belongs to the logged-in user.
   • DVertical privilege escalation; require a stronger session token for order viewing.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is implementing a new authorization system to prevent privilege escalation. They want to ensure that a user cannot access admin functions even if they guess the URL. Which approach is the most effective?

   • AHide admin links in the UI using CSS.
   • BUse a longer, random URL for admin functions.
   • CRequire users to re-authenticate before accessing admin functions.
   • DImplement role-based access control (RBAC) with server-side checks on every request.
   Reveal Solution Discussion Select an answer first