CAS-003 · Question #106
After being notified of an issue with the online shopping cart, where customers are able to arbitrarily change the price of listed items, a programmer analyzes the following piece of code used by a…
The correct answer is C. TOCTOU. This scenario describes a Time-of-Check to Time-of-Use (TOCTOU) race condition. The temporary file name is predictable because it's constructed from user-supplied input and a timestamp (e.g., 'smartphone-12-25-2013.tmp'). An attacker can exploit the window between when the file…
Question
After being notified of an issue with the online shopping cart, where customers are able to arbitrarily change the price of listed items, a programmer analyzes the following piece of code used by a web based shopping cart. SELECT ITEM FROM CART WHERE ITEM=ADDSLASHES($USERINPUT); The programmer found that every time a user adds an item to the cart, a temporary file is created on the web server /tmp directory. The temporary file has a name which is generated by concatenating the content of the $USERINPUT variable and a timestamp in the form of MM-DD- YYYY, (e.g. smartphone-12-25-2013.tmp) containing the price of the item being purchased. Which of the following is MOST likely being exploited to manipulate the price of a shopping cart's items?
Options
- AInput validation
- BSQL injection
- CTOCTOU
- DSession hijacking
How the community answered
(29 responses)- A3% (1)
- B10% (3)
- C69% (20)
- D17% (5)
Explanation
This scenario describes a Time-of-Check to Time-of-Use (TOCTOU) race condition. The temporary file name is predictable because it's constructed from user-supplied input and a timestamp (e.g., 'smartphone-12-25-2013.tmp'). An attacker can exploit the window between when the file is created (checked) and when it is read by the server to process the order (used). Because the filename is predictable, an attacker could race to replace the file with a modified version containing a lower price before the server reads it. SQL injection is mitigated by ADDSLASHES(), input validation addresses format issues rather than race conditions, and session hijacking targets authentication tokens-none of these explain price manipulation through a file race condition.
Topics
Community Discussion
No community discussion yet for this question.