Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

A security analyst reviews a vulnerability assessment report for an enterprise web application that processes uploaded XML documents. The report indicates that the application parser evaluates Document Type Definitions (DTDs) containing external system references and subsequently passes unvalidated XML node content into backend database calls. Which of the following statements accurately identify the security risks present and their appropriate application-level remediations? (Select TWO.)

  1. The application parser is susceptible to XML External Entity (XXE) attacks, which can be mitigated by configuring the parser to disable external DTD resolution.Answer
  2. Passing unvalidated XML inputs directly into database queries introduces a SQL injection vulnerability, which requires parameterized queries to resolve safely.Answer
  3. C
    The flaw represents an instance of client-side Cross-Site Scripting (XSS), which must be remediated primarily by setting the HttpOnly flag on session cookies.
  4. D
    Configuring network-level stateful inspection firewall rules will sanitize the application layer XML payload without requiring code or parser configuration changes.

Answer

The application is susceptible to XML External Entity (XXE) attacks, mitigated by disabling external DTD resolution, and SQL injection from unsanitized inputs, mitigated by parameterized queries.
The scenario highlights two distinct application layer vulnerabilities. First, evaluating external entities within XML inputs enables XML External Entity (XXE) attacks, which are properly mitigated by disabling DTD/external entity resolution in the XML parser configuration. Second, inserting unsanitized XML values directly into database calls creates SQL injection risks, which are remediated by implementing parameterized queries.

Step-by-Step Solution

1
Analyze the XML parsing flaw described in the scenario.
Identified that evaluating Document Type Definitions (DTDs) with external references allows XML External Entity (XXE) processing vulnerabilities.
XML parsers configured to resolve external entities risk exposing local system files and facilitating server-side request forgery.
2
Analyze the database interaction flaw described in the scenario.
Identified that passing unsanitized XML node values into database calls exposes the backend to SQL injection.
Dynamic query construction using untrusted input allows attackers to manipulate database query execution logic.
3
Select the proper application-level security controls.
Selected disabling DTD processing/external entity resolution and enforcing parameterized queries.
Application vulnerabilities require secure code practices and safe parser configurations rather than network firewall controls.

Key Concept

XML External Entity (XXE) Resolution and Input Parameterization
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic