Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

A security analyst is auditing a legacy enterprise reporting application. While reviewing the source code responsible for exporting document files, the analyst notes that user-supplied input parameters are directly concatenated into a system command string passed to an operating system command shell executor (`exec()`). The development team proposes mitigating this risk by deploying a Web Application Firewall (WAF) rule designed to inspect requests and block common SQL keywords such as `SELECT`, `INSERT`, and `UNION`. Which of the following evaluations best explains why the proposed mitigation is ineffective?

  1. The proposed control filters database query manipulation techniques rather than operating system shell commands, failing to remediate the un-sanitized command string execution in application code.Answer
  2. B
    The application code is vulnerable to Cross-Site Scripting (XSS), meaning malicious script payloads will execute within the victim browser session rather than on the server host.
  3. C
    Deploying network boundary firewalls and modifying host routing tables will fully mitigate software command injection flaws without requiring code-level changes.
  4. D
    The security defect is caused by broken access control, so enforcing multi-factor authentication will automatically prevent command execution payloads.

Answer

The proposed control targets database query manipulation rather than operating system shell commands, failing to remediate the un-sanitized command string execution in application code.
The correct answer accurately points out that filtering database query terms addresses SQL Injection, whereas the vulnerability present is OS Command Injection. Because the server executes arbitrary system commands via un-sanitized string concatenation, SQL keyword filters provide no protection against shell metacharacters or operating system utilities.

Step-by-Step Solution

1
Analyze the vulnerability type in the application stem.
User input concatenated into system execution functions (`exec()`) indicates an OS Command Injection flaw.
Identifying the root cause specifies what input structures and system APIs are exploited.
2
Evaluate the proposed mitigation mechanism against the vulnerability type.
Blocking SQL syntax (`SELECT`, `UNION`) mitigates SQL Injection (SQLi), not system shell command invocation.
Security controls must match the specific attack vector and context.
3
Select the correct evaluation that identifies the flaw in the proposed control.
The correct response notes that filtering database query syntax leaves the OS command execution paths unmitigated.
Remediation requires parameterized execution or strict input sanitization suited for shell commands.

Key Concept

OS Command Injection and Context-Appropriate Mitigation Controls
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic