Examkin

Soru

Zorluk: KolayApplication and Software Vulnerabilities

A system administrator tests a diagnostic page on an internal network dashboard that allows users to test ping utility responses by submitting an IP address. The web application passes the input string directly to a server-side shell script without sanitization. When the administrator inputs `127.0.0.1; cat /etc/passwd`, the output displays the server's user account database. Which of the following application vulnerabilities is present?

  1. Command InjectionCevap
  2. B
    Cross-Site Scripting (XSS)
  3. C
    Broken Authorization
  4. D
    Missing Network Firewall Rule

Cevap

Command Injection occurs when application code concatenates unsanitized user input directly into system shell command strings, enabling unauthorized command execution.
The correct answer identifies Command Injection because the application passes raw user input to a host shell interpreter without sanitization or parameterization. The semicolon metacharacter allows arbitrary secondary OS commands (`cat /etc/passwd`) to execute with the privileges of the web application service account.

Adım Adım Çözüm

1
Analyze the application behavior described in the scenario
The application appends user input (`127.0.0.1; cat /etc/passwd`) directly into a server-side command interpreter.
Understanding how the input is processed reveals whether the flaw is client-side, database-level, or system-level.
2
Identify the shell metacharacter and payload execution
The semicolon `;` acts as a command separator in unix-like shells, executing `cat /etc/passwd` immediately after the ping command.
Executing host operating system commands through untrusted web input characterizes command injection.
3
Match the observed attack vector with the correct vulnerability term
The flaw is identified as Command Injection (OS Command Injection).
Proper input validation, parameterized API calls, or avoiding shell execution calls entirely remediate this specific application flaw.

Anahtar Kavram

Command Injection (OS Command Injection)
Bu soruyu puanla

Konular

Application and Software Vulnerabilities

Bu konudan daha fazla soru