A security analyst reviews a vulnerability assessment report for an enterprise web application that processes uploaded XML documents. The report indicates that the application parser evaluates Document Type Definitions (DTDs) containing external system references and subsequently passes unvalidated XML node content into backend database calls. Which of the following statements accurately identify the security risks present and their appropriate application-level remediations? (Select TWO.)
- The application parser is susceptible to XML External Entity (XXE) attacks, which can be mitigated by configuring the parser to disable external DTD resolution.Cevap
- Passing unvalidated XML inputs directly into database queries introduces a SQL injection vulnerability, which requires parameterized queries to resolve safely.Cevap
- CThe flaw represents an instance of client-side Cross-Site Scripting (XSS), which must be remediated primarily by setting the HttpOnly flag on session cookies.
- DConfiguring network-level stateful inspection firewall rules will sanitize the application layer XML payload without requiring code or parser configuration changes.
Cevap
The application is susceptible to XML External Entity (XXE) attacks, mitigated by disabling external DTD resolution, and SQL injection from unsanitized inputs, mitigated by parameterized queries.
The scenario highlights two distinct application layer vulnerabilities. First, evaluating external entities within XML inputs enables XML External Entity (XXE) attacks, which are properly mitigated by disabling DTD/external entity resolution in the XML parser configuration. Second, inserting unsanitized XML values directly into database calls creates SQL injection risks, which are remediated by implementing parameterized queries.
Adım Adım Çözüm
Anahtar Kavram
XML External Entity (XXE) Resolution and Input Parameterization