Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

An application developer is reviewing security logs following an incident where a backend microservice was compromised. The investigation reveals that an external attacker submitted a base64-encoded serialized object within an HTTP header, triggering execution of arbitrary system commands on the hosting server. Which of the following vulnerabilities was exploited, and what is the most effective code-level remediation to prevent future occurrences?

  1. Insecure deserialization; replace object serialization with a safe data format like JSON or implement strict type validation on object streams.Answer
  2. B
    Cross-site scripting (XSS); implement context-aware output encoding and sanitize all untrusted parameter inputs on the client side.
  3. C
    Broken authorization; enforce mandatory multi-factor authentication (MFA) and role-based access control (RBAC) on the endpoint.
  4. D
    Unrestricted egress traffic; configure network-layer firewall rules and microsegmentation to block outgoing server connections.

Answer

Insecure deserialization; replace object serialization with a safe data format like JSON or implement strict type validation on object streams.
Insecure deserialization occurs when an application receives serialized objects from untrusted sources and reconstructs them without adequate validation. Attackers manipulate serialized data structures to execute arbitrary commands on the application server. The primary remediation is to replace native object serialization with safer data interchange formats, such as JSON or Protocol Buffers, or strictly validate allowed object classes before instantiation.

Step-by-Step Solution

1
Analyze the attack vector described in the incident logs.
The attacker sent a base64-encoded serialized object payload that resulted in server-side remote command execution.
Reconstructing objects from untrusted input without prior validation is the primary characteristic of an insecure deserialization flaw.
2
Differentiate application-level software flaws from network or client-side vulnerabilities.
The flaw resides in how backend code parses incoming objects, requiring software-level remediation.
Neither client-side encoding nor network firewall rules fix bad object-deserialization logic in server code.
3
Determine the appropriate code-level mitigation.
Refactor application code to use standard, non-executable data formats such as JSON or enforce object filtering.
Replacing native object serialization eliminates the mechanism used to instantiate unexpected malicious class graphs.

Key Concept

Insecure Deserialization Vulnerability and Remediation
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic