Ethical Hacking Essentials Practice Test

Which web application security risk was exploited when restrictions for authenticated users were not properly enforced?

1. Cross-Site Scripting

2. Broken Access Control

3. Session Fixation

4. XSRF

The correct answer is: Broken Access Control

Broken Access Control refers to vulnerabilities that occur when authenticated users can access unauthorized resources, often due to insufficient restrictions placed on what actions these users can perform. This risk arises when applications do not properly enforce security measures after a user has logged in, allowing them to bypass necessary checks that would normally restrict their access to certain functions or data. In the scenario presented, the lack of proper enforcement of restrictions for authenticated users makes it possible for those users to exploit the application. This could involve gaining access to sensitive information, modifying data they should not have the authority to access, or even performing administrative functions without the necessary permissions. Such weaknesses often stem from poor implementation of access controls in the application's code. In contrast, the other options listed relate to different kinds of security issues. For example, Cross-Site Scripting involves injecting malicious scripts into web pages, while Session Fixation focuses on exploiting session management flaws. Cross-Site Request Forgery (XSRF) occurs when unauthorized commands are transmitted from a user that the website trusts. Each of these vulnerabilities involves different mechanisms and implications, but Broken Access Control specifically addresses the failure to enforce access limitations for authenticated users.