Examkin

Question

Difficulty: Very hardApplication and Software Vulnerabilities

During a comprehensive security audit of an enterprise microservices web platform, an analyst examines two service implementations. Service 1 is an avatar generator that receives a user-supplied web URL via an HTTP POST request, fetches the image resource directly from that URL using a server-side HTTP client, and stores it in internal object storage without restricting target IP addresses or domains. Service 2 is a catalog search service that accepts input strings from search queries and directly concatenates them into dynamic SQL strings executed against the backend database.

Which of the following vulnerability classifications are present in these microservices, and which recommended controls effectively mitigate them? (Select THREE.)

  1. Server-Side Request Forgery (SSRF) is present in Service 1 because the application fetches remote resources based on user-supplied URLs without restricting outbound requests or validating target IP destinations.Answer
  2. SQL Injection (SQLi) is present in Service 2 because user input is directly concatenated into database query strings instead of using prepared statements or parameterized queries.Answer
  3. Implementing strict egress network filtering, URL domain allowlists, and blocking access to loopback and internal private IP ranges remediates the SSRF vulnerability in Service 1.Answer
  4. D
    Cross-Site Scripting (XSS) is present in Service 2 because dynamic query concatenation forces the database engine to interpret client-side JavaScript payloads.
  5. E
    Enforcing database-level Role-Based Access Control (RBAC) on the application connection service account completely resolves the query concatenation vulnerability in Service 2 without requiring source code modifications.

Answer

The application suffers from Server-Side Request Forgery (SSRF) in the avatar microservice and SQL Injection (SQLi) in the catalog search microservice. Effective mitigations include implementing egress network filtering, URL allowlisting, and restricting internal IP access for the avatar service, as well as replacing dynamic string concatenation with parameterized queries for the catalog search service.
The correct options accurately identify the two software vulnerabilities present in the scenario and specify an effective mitigation strategy for the SSRF flaw. Service 1 exhibits Server-Side Request Forgery (SSRF) because it fetches remote content based on client-provided URLs without constraining destination addresses or prohibiting requests to loopback/private IPs. Service 2 exhibits SQL Injection (SQLi) because input is dynamically concatenated into database queries. Remediating SSRF requires strict egress network filtering, URL allowlisting, and blocking access to internal management interfaces.

Step-by-Step Solution

1
Analyze Service 1 behavior (fetching external URL server-side).
Identified Server-Side Request Forgery (SSRF). The server trusts user input to make backend HTTP requests without validating if the destination IP is internal or forbidden.
When a server receives a URL from a client and retrieves the resource without restricting target address space, it creates an SSRF vulnerability.
2
Analyze Service 2 behavior (dynamic string concatenation into SQL statements).
Identified SQL Injection (SQLi). Untrusted input directly alters database command syntax.
Direct concatenation of user-supplied data into database queries allows attackers to break out of data context into query code context.
3
Evaluate appropriate technical mitigation controls for identified vulnerabilities.
Confirmed that egress network controls, URL allowlisting, and disabling access to private IP blocks mitigate SSRF, while parameterization mitigates SQLi.
Defensive controls must directly address the architectural root cause (preventing unauthorized server requests for SSRF, and isolating data from query execution logic for SQLi).

Key Concept

Software vulnerability identification and remediation (SSRF and SQL Injection)
Rate this question

Topics

Application and Software Vulnerabilities

More questions from this topic