Which of the following threat types involves an application developer leaving references to internal information and configurations in code that is exposed to the client?

Question

Options

• ASensitive data exposure
• BSecurity misconfiguration
• CInsecure direct object references
• DUnvalidated redirect and forwards

• A
  2% (1)
• B
  2% (1)
• C
  91% (49)
• D
  6% (3)

Explanation

Insecure Direct Object References (IDOR) occurs when a developer directly exposes internal implementation details - such as database keys, file paths, or configuration identifiers - in client-facing code (HTML source, URLs, hidden form fields), allowing attackers to enumerate or manipulate those references to access unauthorized resources.

Why the distractors are wrong:

• A (Sensitive data exposure) is about failing to protect data at rest or in transit (e.g., unencrypted passwords or credit card numbers) - it's about protection of the data itself, not about referencing internal structures.
• B (Security misconfiguration) refers to improper settings on servers, frameworks, or cloud environments (e.g., default credentials, open S3 buckets) - it's a platform/config issue, not developer-left code references.
• D (Unvalidated redirects and forwards) is about applications that redirect users to attacker-controlled URLs without validation, enabling phishing - unrelated to exposing internal references.

Memory tip: Think "IDOR = Insider Reference Exposed to an Outsider." The developer left an internal object reference (a database ID, a file path) visible to the client, giving an attacker a roadmap to probe internal systems.

No community discussion yet for this question.