312-50 Question 349
Single answer▪ Web App SecurityDuring an authorized web application assessment, you review an online payroll portal that uses the following request after login: GET /paystub?empId=1042 HTTP/1.1. When you change the parameter to empId=1043, the server returns another employee's paystub, even though your authenticated account should not have access to that record. The application uses HTTPS and a valid session cookie, but there is no server-side check that the requested empId belongs to the logged-in user. Which vulnerability best describes this issue?
- A
Insecure Direct Object Reference (IDOR) / Broken Access Control
- B
Cross-Site Request Forgery (CSRF)
- C
SQL Injection
- D
Session Fixation
Show answer and explanation
Correct answer: A
Explanation
The best answer is Insecure Direct Object Reference (IDOR), a common example of Broken Access Control. The key clue is that modifying a predictable identifier allows access to another user's data without any server-side authorization check. This is not prevented by HTTPS, because transport encryption protects data in transit, not authorization logic. Modern guidance, including the OWASP Top 10, treats these flaws under Broken Access Control and recommends enforcing object-level authorization on every request, using indirect references where appropriate, and validating that the requested resource belongs to the authenticated user. In a real assessment, this finding would be high severity because it exposes sensitive payroll data and demonstrates horizontal privilege escalation.
- A. Correct.
Correct. This is a classic IDOR scenario, now broadly categorized under Broken Access Control. The application exposes a direct reference to an internal object identifier (empId) and fails to enforce authorization on the server side. Simply being authenticated is not sufficient; the server must verify that the current user is permitted to access the specific resource requested.
- B. Incorrect.
Incorrect. CSRF involves tricking an authenticated user’s browser into sending unintended requests to the application, typically by exploiting the browser’s automatic inclusion of cookies. In this scenario, the tester is manually modifying a parameter and receiving unauthorized data because of missing authorization checks, not causing another user’s browser to submit a forged request.
- C. Incorrect.
Incorrect. SQL Injection occurs when untrusted input is interpreted as part of a SQL query, allowing an attacker to alter database behavior. Although parameter tampering is present here, there is no indication that the input is being used to manipulate SQL syntax. The issue is unauthorized object access due to weak access control, not query injection.
- D. Incorrect.
Incorrect. Session Fixation occurs when an attacker forces or predicts a user’s session identifier so the attacker can hijack the session after the victim authenticates. Here, the session is already valid and the problem is that the application does not properly restrict access to resources referenced by empId.