PT0-001 · Question #241
A penetration tester is testing a web application and is logged in as a lower-privileged user. The tester runs arbitrary JavaScript within an application, which sends an XMLHttpRequest, resulting in…
The correct answer is A. Implement authorization checks. When a low-privileged user can execute JavaScript that accesses administrator-only application features via XMLHttpRequest, the root cause is missing server-side authorization checks, not input sanitization.
Question
A penetration tester is testing a web application and is logged in as a lower-privileged user. The tester runs arbitrary JavaScript within an application, which sends an XMLHttpRequest, resulting in exploiting features to which only an administrator should have access. Which of the following controls would BEST mitigate the vulnerability?
Options
- AImplement authorization checks.
- BSanitize all the user input.
- CPrevent directory traversal.
- DAdd client-side security controls
How the community answered
(46 responses)- A78% (36)
- B7% (3)
- C2% (1)
- D13% (6)
Why each option
When a low-privileged user can execute JavaScript that accesses administrator-only application features via XMLHttpRequest, the root cause is missing server-side authorization checks, not input sanitization.
The vulnerability described is Broken Access Control - the server processes the administrative request without verifying the requesting user has sufficient privileges. Implementing server-side authorization checks ensures every sensitive function validates the caller's role or permissions before execution. This directly addresses the flaw, since client-supplied requests regardless of origin must be authorized on the server.
Input sanitization mitigates injection attacks such as XSS or SQL injection; it does not prevent an authenticated low-privilege user from accessing unauthorized server-side functions.
Directory traversal prevention stops path-based file access attacks and is unrelated to horizontal or vertical privilege escalation via API calls.
Client-side security controls can be trivially bypassed by an attacker who can already execute arbitrary JavaScript, making them ineffective against this type of access control flaw.
Concept tested: Broken access control and server-side authorization enforcement
Source: https://owasp.org/www-community/vulnerabilities/Missing_Function_Level_Access_Control
Topics
Community Discussion
No community discussion yet for this question.