Identifying API Vulnerability: Missing ABAC Validation
Short answer
A No ABAC validation allows hackers to gain unauthorized access to API objects and perform actions such as view, update, and delete sensitive data of the company.
Question
Ron, a security professional, was pen testing web applications and SaaS platforms used by his company. While testing, he found a vulnerability that allows hackers to gain unauthorized access to API objects and perform actions such as view, update, and delete sensitive data of the company. What is the API vulnerability revealed in the above scenario?
Key Takeaways
The question tests recognition of specific access control flaws in APIs, specifically distinguishing between general logic errors and explicit authorization failures like missing ABAC.
This question identifies an API vulnerability where attackers can manipulate sensitive data due to missing attribute-based access control. The correct answer is A, as the lack of ABAC validation directly enables unauthorized view, update, and delete actions.
Common mistake: Learners often confuse this with Business Logic Flaws (B) or CORS issues (C), failing to recognize that the specific ability to perform CRUD operations on objects points to a direct authorization failure rather than a flow or cross-origin issue.
Expert Analysis
Why the Answer Is Correct
The scenario describes an attacker gaining unauthorized access to API objects to perform view, update, and delete actions. This is a classic description of a broken object level authorization (BOLA) or more broadly, a failure in Access Control. Option A, "No ABAC validation," is the correct choice because Attribute-Based Access Control (ABAC) is a policy-driven model that grants access based on attributes of the user, resource, and environment. If ABAC is not implemented or validated, the API cannot restrict users from accessing or modifying objects they are not authorized to touch, leading exactly to the described outcome.Why the Other Options Are Wrong
Business logic flaws (B) refer to errors in the workflow or rules of the application (e.g., bypassing a payment step), not necessarily direct unauthorized data manipulation via API endpoints. Improper use of CORS (C) allows cross-origin requests but does not inherently grant permission to read or write data if server-side authorization is correctly enforced; it’s a client-side protection mechanism, not a server-side access control one. Code injections (D) involve injecting malicious scripts or code to execute, which is distinct from simply accessing data through legitimate API endpoints without proper authorization checks.Community Comment Notes
The community overwhelmingly selected A, citing CEHv12 materials. As shaody noted, "Lack of proper ABAC validation allows attackers to gain unauthorized access to API objects." Another user, insaniunt, clarified that "the API does not implement proper attribute-based access control... to verify the permissions." This consensus aligns with the exam's focus on specific access control models in modern web applications.Exam Strategy
When analyzing API vulnerabilities, look for keywords related to 'objects', 'resources', and 'actions' (view/update/delete). If the issue is about who can do what to a specific item, think Authorization (ABAC/RBAC). If the issue is about how the app handles data flow or inputs, think Logic or Injection.
Frequently Asked Questions
Why is BOLA not an option here?
BOLA is a type of IDOR. In this specific EC-Council context, the root cause is identified as the lack of ABAC validation mechanisms to enforce those restrictions.
How does CORS differ from ABAC?
CORS controls browser-based cross-origin requests, while ABAC is a server-side policy engine that determines if a user has permission to access a specific resource based on attributes.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.
From public community threads 4
-
insaniunt 👍 1 Answered AA. No ABAC validation. This means that the API does not implement proper attribute-based access control (ABAC) to verify the permissions of the users who request access to the API object
-
shaody 👍 1 Answered ALack of proper ABAC validation allows attackers to gain unauthorized access to API objects or actions to perform viewing, updating, or deleting.
-
qwerty100 👍 1 Answered AA. No ABAC validation
-
kenjeshry 👍 1 Answered ACEHv12 p2095
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.