300-215 · Question #42
A security team needs to prevent a remote code execution vulnerability. The vulnerability can be exploited only by sending '${' string in the HTTP request. WAF rule is blocking '${', but system…
The correct answer is A. Enable URL decoding on WAF. Attackers can URL-encode the ${ sequence (e.g. %24%7B) to bypass a literal string block. Enabling URL decoding ensures the WAF normalizes and inspects decoded payloads, catching the ${ before it reaches the application.
Question
A security team needs to prevent a remote code execution vulnerability. The vulnerability can be exploited only by sending ‘${‘ string in the HTTP request. WAF rule is blocking ‘${‘, but system engineers detect that attackers are executing commands on the host anyway. Which action should the security team recommend?
Options
- AEnable URL decoding on WAF.
- BBlock incoming web traffic.
- CAdd two WAF rules to block 'S' and '{' characters separately.
- DDeploy antimalware solution.
How the community answered
(34 responses)- A76% (26)
- B3% (1)
- C15% (5)
- D6% (2)
Explanation
Attackers can URL-encode the ${ sequence (e.g. %24%7B) to bypass a literal string block. Enabling URL decoding ensures the WAF normalizes and inspects decoded payloads, catching the ${ before it reaches the application.
Topics
Community Discussion
No community discussion yet for this question.