CCSP · Question #442
Which of the following threat types can occur when an application does not properly validate input and can be leveraged to send users to malicious sites that appear to be legitimate?
The correct answer is A. Unvalidated redirects and forwards. Unvalidated Redirects and Forwards is an OWASP-recognized vulnerability where an application accepts user-controlled input to determine a redirect destination without validating it. An attacker can craft a legitimate-looking URL (pointing to the trusted site) that contains a…
Question
Which of the following threat types can occur when an application does not properly validate input and can be leveraged to send users to malicious sites that appear to be legitimate?
Options
- AUnvalidated redirects and forwards
- BInsecure direct object references
- CSecurity miscomfiguration
- DSensitive data exposure
How the community answered
(36 responses)- A92% (33)
- C3% (1)
- D6% (2)
Explanation
Unvalidated Redirects and Forwards is an OWASP-recognized vulnerability where an application accepts user-controlled input to determine a redirect destination without validating it. An attacker can craft a legitimate-looking URL (pointing to the trusted site) that contains a redirect parameter pointing to a malicious site, effectively using the trusted domain's reputation for a phishing attack. Insecure direct object references (B) expose internal objects, security misconfiguration (C) involves improperly configured settings, and sensitive data exposure (D) involves failing to protect stored or transmitted data.
Topics
Community Discussion
No community discussion yet for this question.