SY0-701 Question 80
Single answer2.3 Explain various types of vulnerabilities.A security analyst is reviewing a new customer support web application after a penetration test. The tester reports that by changing the value in the URL from /invoice/10021 to /invoice/10022, a logged-in user can view another customer's invoice without any additional authorization checks. The application does not expose server errors and uses HTTPS correctly. Which of the following best describes the vulnerability that should be remediated first?
- A
Cross-site scripting (XSS)
- B
SQL injection
- C
Insecure direct object reference (IDOR)
- D
Buffer overflow
Show answer and explanation
Correct answer: C
Explanation
The best answer is Insecure direct object reference (IDOR). This is a common web application vulnerability caused by missing object-level authorization. Even when a user is properly authenticated and the application uses HTTPS, the application must still validate that the user is authorized to access each requested resource. This type of weakness is closely aligned with broken access control and is commonly highlighted in secure development guidance such as the OWASP Top 10 and OWASP authorization testing guidance. Proper remediation includes enforcing server-side authorization checks on every object request, avoiding predictable direct references where possible, and validating access based on the authenticated user's role or ownership of the resource.
- A. Incorrect.
Incorrect. Cross-site scripting (XSS) involves injecting malicious scripts into content viewed by other users, typically due to improper input/output handling in the browser. In this scenario, the issue is unauthorized access to another user's resource by modifying an object identifier, not script execution in a victim's browser.
- B. Incorrect.
Incorrect. SQL injection occurs when unsanitized input is interpreted as part of a backend SQL query. Although parameter tampering can sometimes lead to SQL injection, the scenario specifically describes predictable resource identifiers being accessed without proper authorization checks. That is an access control flaw, not necessarily a database query manipulation issue.
- C. Correct.
Correct. Insecure direct object reference (IDOR) is an authorization vulnerability in which an application exposes a reference to an internal object, such as an invoice number or record ID, and fails to verify that the authenticated user is allowed to access that object. Changing /invoice/10021 to /invoice/10022 and successfully viewing another customer's data is a classic IDOR example.
- D. Incorrect.
Incorrect. Buffer overflow vulnerabilities occur when a program writes more data to a memory buffer than it can hold, potentially causing crashes or code execution. This is generally associated with memory-unsafe programming issues, not with a web application exposing unauthorized records through manipulated identifiers.