A transit admin delete action is blocked on POST but succeeds when the same URL is requested with PUT or DELETE. What attack class does this illustrate?
Select an answer to reveal the explanation.
Short Explanation
Guards who only check the front door miss the side entrance. If authz is wired only to POST, other verbs can sneak the same action through. That is HTTP verb tampering — same resource, different method, different outcome.
Full Explanation
HTTP verb tampering occurs when alternate methods unlock privileged operations that appear blocked for the common verb. A transit admin delete blocked on POST but succeeding with PUT or DELETE shows authorization or routing that is method-inconsistent—attackers (and testers) try other verbs to bypass incomplete controls on civic admin functions.
DNS cache poisoning and ARP spoofing are network attacks, not application method inconsistencies. The scenario is the opposite of strict method allowlisting that covers all verbs equally.
Exam caveat: authorize by operation and object, not by assuming “POST blocked means delete impossible.” CPTS access-control testing includes method mutation on municipal admin APIs.
Operational check: try safe alternate verbs on sensitive transit admin routes within RoE, enforce allowlisted methods at app and reverse-proxy layers, ensure authorization runs for every verb, and regression-test delete/update paths. Reverse proxies in front of transit admin APIs should drop disallowed verbs before requests hit application code that might authorize inconsistently. Method allowlists at the reverse proxy protect transit admin routes even if an app handler regresses.