Examkin

Question

Difficulty: MediumApplication and Software Vulnerabilities

A security team is reviewing a web microservice that accepts user-supplied remote image URLs to generate user avatar previews. During testing, an analyst discovers that submitting a URL directed to `http://169.254.169.254/latest/meta-data/` allows the server to fetch and return sensitive cloud instance credentials to the client.

Which of the following mitigation controls should the development team implement to remediate this application vulnerability? (Select TWO.)

  1. Restrict the application server from initiating outbound network connections to internal IP address ranges and cloud metadata endpointsAnswer
  2. Implement strict input validation using an allowlist of approved URL schemes and external domain destinationsAnswer
  3. C
    Apply contextual HTML entity encoding to user inputs prior to rendering response pages in the browser
  4. D
    Enforce parameterized SQL queries and prepared statements for all database retrieval functions

Answer

The correct remediation controls are restricting the application server from initiating outbound network connections to internal IP addresses and cloud metadata endpoints, and implementing strict input validation using an allowlist of approved URL schemes and external domains.
The scenario describes a Server-Side Request Forgery (SSRF) vulnerability where an attacker manipulates the server into fetching cloud metadata (`169.254.169.254`). Remediating SSRF requires preventing the server from connecting to internal endpoints by restricting outbound network connections to private IP spaces and validating user-supplied URLs against an explicit allowlist of domain names and protocols.

Step-by-Step Solution

1
Identify the underlying application vulnerability from the observed scenario.
The application suffers from Server-Side Request Forgery (SSRF), where an attacker forces the server to make unauthorized requests to internal endpoints like cloud metadata services.
Understanding the attack vector (server fetching backend resources on behalf of untrusted input) dictates the proper defense.
2
Evaluate network-level and egress filtering controls for SSRF mitigation.
Restricting outbound traffic to internal IP ranges (127.0.0.1, 169.254.169.254, RFC 1918) blocks the server from reaching sensitive internal services even if a URL is submitted.
Egress filtering limits the blast radius of SSRF by denying network access to private management APIs.
3
Evaluate application-level input validation controls.
Enforcing an allowlist of accepted schemes (HTTPS) and approved external domains prevents user inputs from referencing local or metadata addresses.
Allowlisting validates input targets before the application attempts to initiate HTTP GET requests.

Key Concept

Server-Side Request Forgery (SSRF) Remediation
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic