Privilege Escalation WAHS Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   During a security review, a tester finds that a regular user can access the /admin/deleteUser endpoint by directly navigating to it, even though the UI does not show the link. What type of privilege escalation is this, and what is the root cause?

   • AVertical privilege escalation; missing function-level access control on the endpoint.
   • BSession fixation; the user's session is hijacked to gain admin rights.
   • CInsecure direct object reference; the endpoint exposes a user ID parameter.
   • DHorizontal privilege escalation; the user is accessing another user's admin account.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security audit reveals that a web application's API allows a user to view other users' invoices by changing the 'invoice_id' in the request. The application uses a session cookie for authentication but does not check if the invoice belongs to the user. What is the most accurate description of this vulnerability?

   • ACross-site scripting (XSS) vulnerability.
   • BVertical privilege escalation via missing function-level access control.
   • CHorizontal privilege escalation via insecure direct object reference.
   • DSession fixation attack.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A web application uses a microservices architecture. The frontend service communicates with a backend service using a shared API key. A penetration tester discovers that by modifying the 'X-User-Role' header in requests to the backend, they can access admin functions. The backend trusts this header. Which of the following is the most effective mitigation?

   • AUse a stronger API key that is harder to guess.
   • BAdd a WAF rule to block requests with an 'X-User-Role' header.
   • CConfigure the backend to ignore the 'X-User-Role' header and derive the user's role from a signed token or session that is validated by the backend.
   • DEncrypt the 'X-User-Role' header value using a symmetric key.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A web application allows users to update their profile by sending a POST request to /profile/update. The request includes a 'user_id' field. A user changes the 'user_id' to another user's ID and successfully updates that user's email address. What is the most effective mitigation?

   • ALog all profile updates to detect unauthorized changes.
   • BIgnore the 'user_id' field in the request and use the ID from the authenticated session to determine which profile to update.
   • CUse a random token in the form to prevent CSRF attacks.
   • DAdd a CAPTCHA to the profile update form to prevent automated attacks.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A web application has a feature that allows users to change their password. The password change request includes the current password and the new password. A penetration tester finds that by removing the 'currentPassword' field from the request, the server accepts the change without verifying the current password. This allows an attacker who has stolen a session token to change the victim's password. Which of the following is the most effective mitigation?

   • AAdd a CAPTCHA to the password change form to slow down automated attacks.
   • BUse a stronger session token that is harder to steal.
   • CLog all password change attempts to detect unauthorized changes.
   • DMake the 'currentPassword' field mandatory and validate it against the authenticated user's stored password hash before allowing the change.
   Reveal Solution Discussion Select an answer first