Objective 2.3: Explain various types of vulnerabilities
Security+ SY0-701 practice question
A penetration tester assesses a gift card API. The redemption endpoint first checks that a card has enough balance and then, in a separate database call, deducts the amount. When the tester sends two redemption requests for the same $50 card within a few milliseconds of each other, both succeed and the tester receives $100 of credit. When the same two requests are sent one second apart, the second request is correctly rejected. Which vulnerability did the tester exploit?
- Buffer overflow
A buffer overflow writes more data into a memory buffer than it can hold, corrupting adjacent memory. The requests here are normal in size and content; only their timing matters.
- Replay attack
A replay attack resends captured valid traffic so the system repeats an action. The decisive detail is that the same requests sent one second apart are rejected: the flaw is not that the server accepts repeated requests, but that two requests processed at the same moment both pass the balance check before either deduction is recorded.
- Race condition(Correct)
Correct. This is a time-of-check to time-of-use race condition. Both requests read the $50 balance before either write happens, so both pass the check. The behavior depends entirely on timing, as the one-second test shows.
- Memory injection
Memory injection places malicious code or data into a running process's memory. The tester never manipulated process memory; they sent two legitimate-looking API requests close together.
Explanation
A race condition exists when the result of an operation depends on the timing of concurrent events. The common form is time-of-check to time-of-use (TOC/TOU): the application checks a condition (the balance) and later acts on it (the deduction), and another request slips in between. The fix is to make check-and-update atomic, for example with a single conditional update, a transaction with proper locking, or an idempotency key.