CAS-003 · Question #763
A company suspects a web server may have been infiltrated by a rival corporation. The security engineer reviews the web server logs and finds the following: The security engineer looks at the code…
The correct answer is C. Separate the items in the system call to prevent command injection. This answer is correct. The vulnerability described - user input passed into a dynamically constructed system/shell call - is classic OS command injection. When user input is concatenated into a shell string (e.g., system('cmd ' + userInput)), an attacker can inject shell…
Question
A company suspects a web server may have been infiltrated by a rival corporation. The security engineer reviews the web server logs and finds the following:
The security engineer looks at the code with a developer, and they determine the log entry is created when the following line is run:
Which of the following is an appropriate security control the company should implement?
Options
- ARestrict directory permission to read-only access.
- BUse server-side processing to avoid XSS vulnerabilities in path input.
- CSeparate the items in the system call to prevent command injection.
- DParameterize a query in the path variable to prevent SQL injection.
How the community answered
(37 responses)- A3% (1)
- B8% (3)
- C84% (31)
- D5% (2)
Explanation
This answer is correct. The vulnerability described - user input passed into a dynamically constructed system/shell call - is classic OS command injection. When user input is concatenated into a shell string (e.g., system('cmd ' + userInput)), an attacker can inject shell metacharacters like ;, &&, or | to append arbitrary OS commands. The fix is to avoid passing a single string to the shell and instead provide the command and its arguments as a separate array/list, so the OS executes them literally without shell interpretation. This is distinct from XSS (B) and SQL injection (D).
Topics
Community Discussion
No community discussion yet for this question.