CAS-002 · Question #186
At 10:35 a.m. a malicious user was able to obtain a valid authentication token which allowed read/write access to the backend database of a financial company. At 10:45 a.m. the security…
The correct answer is D. A race condition has occurred. The attacker's authentication token obtained before the password reset remains valid and continues to authorize transactions - a race condition between token validity and the credential change.
Question
At 10:35 a.m. a malicious user was able to obtain a valid authentication token which allowed read/write access to the backend database of a financial company. At 10:45 a.m. the security administrator received multiple alerts from the company's statistical anomaly-based IDS about a company database administrator performing unusual transactions. At 10:55 a.m. the security administrator resets the database administrator's password. At 11:00 a.m. the security administrator is still receiving alerts from the IDS about unusual transactions from the same user. Which of the following is MOST likely the cause of the alerts?
Options
- AThe IDS logs are compromised.
- BThe new password was compromised.
- CAn input validation error has occurred.
- DA race condition has occurred.
How the community answered
(64 responses)- A13% (8)
- B6% (4)
- C25% (16)
- D56% (36)
Why each option
The attacker's authentication token obtained before the password reset remains valid and continues to authorize transactions - a race condition between token validity and the credential change.
Compromised IDS logs would suppress or falsify alerts rather than cause the continuation of actual unauthorized database transactions against the live system.
A newly compromised password cannot explain the immediate resumption of the same session activity at 11:00 a.m., as the attacker already possesses a valid token that bypasses password authentication.
Input validation errors cause application-level data processing issues and would not produce the pattern of authenticated, ongoing database transactions observed after a password reset.
A race condition exists because the malicious user acquired a valid session token at 10:35 that grants direct database access, and resetting the account password at 10:55 does not automatically invalidate that already-issued token. The token continues to be honored by the system until it expires or is explicitly revoked, allowing unauthorized transactions to persist after the password change - this is the defining characteristic of a session token race condition.
Concept tested: Session token race condition and token invalidation on credential reset
Source: https://owasp.org/www-community/attacks/Race_condition
Topics
Community Discussion
No community discussion yet for this question.