During a security review of a custom web reporting service, a security analyst identifies two distinct software vulnerabilities: dynamic user input in the template string parameter is evaluated directly by the rendering engine allowing remote code execution, and un-sanitized file path inputs allow accessing arbitrary system files outside the web root. Which of the following remediation strategies should the development team implement to mitigate these specific vulnerabilities? (Select TWO.)
- Implement strict input validation and path canonicalization to restrict file access strictly within intended directories.Answer
- BEnforce parameterized database queries using prepared statements across all endpoint handlers.
- Disable dynamic evaluation within the template renderer and restrict rendering to pre-approved static templates.Answer
- DReconfigure host-based firewall rules to restrict incoming network traffic to application port 443.
Answer
To remediate the identified directory traversal and server-side template injection (SSTI) vulnerabilities, the development team must implement path canonicalization with strict input validation for file access, and disable dynamic evaluation while restricting rendering to pre-approved static templates.
Path canonicalization resolves relative directory references (such as dot-dot-slash sequences) into absolute file paths and checks them against permitted folder boundaries to prevent file traversal. Removing dynamic code execution features from the template engine and restricting rendering to static templates prevents server-side template injection (SSTI) attacks.
Step-by-Step Solution
Key Concept
Application input validation, path canonicalization, and safe template rendering practices.