Threat Types of Improper Input Validation

A.

Many web applications offer redirect or forward pages that send users to different, external sites.

If these pages are not properly secured and validated, attackers can use the application to forward users off to sites for phishing or malware attempts.

These attempts can often be more successful than direct phishing attempts because users will trust the site or application that sent them there, and they will assume it has been properly validated and approved by the trusted application's owners or operators.

Security misconfiguration occurs when applications and systems are not properly configured for security--often a result of misapplied or inadequate baselines.

Insecure direct object references occur when code references aspects of the infrastructure, especially internal or private systems, and an attacker can use that knowledge to glean more information about the infrastructure.

Sensitive data exposure occurs when an application does not use sufficient encryption and other security controls to protect sensitive application data.

The correct answer is A. Unvalidated redirects and forwards.

Unvalidated redirects and forwards is a type of threat that occurs when an application allows a user to redirect or forward to a different web page without proper validation of the target URL. This vulnerability can be exploited by an attacker to send users to a malicious website that appears to be legitimate. This technique is commonly known as phishing, where attackers attempt to trick users into disclosing sensitive information such as login credentials, personal data, or financial information.

For example, an attacker can create a link that appears to be legitimate, but the target URL is actually a malicious website. The attacker can then persuade a user to click on the link by embedding it in an email or social media post. If the application allows unvalidated redirects and forwards, the user will be redirected to the malicious website, where the attacker can collect the user's sensitive information.

Insecure direct object references is a type of vulnerability that occurs when an application exposes a reference to an internal object, such as a file or database record, without proper authorization. This can allow an attacker to access sensitive information or modify data without proper permission.

Security misconfiguration is a type of vulnerability that occurs when an application is not properly configured, leading to security weaknesses that can be exploited by attackers.

Sensitive data exposure is a type of vulnerability that occurs when an application exposes sensitive information, such as login credentials or financial information, without proper protection. This can be exploited by attackers to steal sensitive data and use it for malicious purposes.

Overall, unvalidated redirects and forwards pose a significant threat to application security and can lead to serious consequences if not properly addressed. It is important for developers to implement proper input validation and redirect mechanisms to mitigate this risk.